Oracle Database Access Restriction Bypass Vulnerability

Affected Systems:Oracle Database 9.2.0.0-10.2.0.3

Description: Bugtraq id: 17426

Oracle is a large commercial database system. Oracle 9.2.0.0 to 10.2.0.3 allows users with only SELECT permission in the base table to insert, update, and delete data through a specially crafted view, low-Permission users who successfully exploit this vulnerability can insert, update, and delete data by creating a specially crafted view.

This vulnerability has a low impact on Oracle data dictionaries because most dictionary tables do not have a primary key, and the exploitation of this vulnerability requires a primary key.

Test Method:

Warning:The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Assume that dbsnmp only has the select any dictionary permission and cannot update Tables in the data DICTIONARY.

C: \> sqlplus dbsnmp/dbsnmp SQL * Plus: Release 10.1.0.4.0-Production on Thu Apr 8 19:20:27 2006 Copyright (c) 1982,200 5, Oracle. All rights reserved. Connected: Oracle Database 10g Enterprise Edition Release 10.1.0.4.0 -Production With the Partitioning, OLAP and Data Mining options SQL> select * from v $ version; BANNER Oracle Database 10g Enterprise Edition Release 10.1.0.4.0 -Prod PL/SQL Release 10.1.0.4.0-Production CORE 10.1.0.4.0 Production TNS for 32-bit Windows: Version 10.1.0.4.0 -Production NLSRTL Version 10.1.0.4.0-Production SQL> -- the data cannot be deleted from the data dictionary) SQL> delete from sys. registry $; Delete from sys. registry $ * ERROR at line 1: ORA-01031: insufficient privileges SQL> -- create a custom View SQL> create or replace view e as select [... censored...]; View created. SQL> -- discard data through the view !!! ==> Security Vulnerabilities !!! SQL> delete from e; 17 rows deleted.

Suggested temporary solution:

If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:

* Filter 9i to 10g R1 connection roles and delete create view and create database link permissions.

* Delete the primary key from the base table. Please note that this may cause performance and integrity problems.

Vendor patch: Oracle

Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version.

Note: <* Source: Alexander Kornbrust ak@red-database-security.com) Link: http://marc.theaimsgroup.com /? L = bugtraq & m = 114468438319540 & w = 2 *>