Oracle PL/SQL Gateway PLSQLExclusion Access Control List Bypass Vulnerability

Source: David Litchfield

Released on: 2006-01-27
Updated on: 2006-01-27

Affected Systems:
Oracle Internet Application Server 1.0.2.1
Oracle Internet Application Server 1.0.2.0
Oracle Oracle10g Application Server 9.0.4.2
Oracle Oracle10g Application Server 9.0.4.1
Oracle Oracle10g Application Server 9.0.4.0
Oracle Oracle10g Application Server 10.1.2.1.0
Oracle Oracle10g Application Server 10.1.2.0.2
Oracle Oracle10g Application Server 10.1.2.0.1
Oracle Oracle10g Application Server 10.1.2
Oracle Oracle10g Application Server 10.1.0.4
Oracle Oracle10g Application Server 10.1.0.3.1
Oracle Oracle10g Application Server 10.1.0.3
Oracle Oracle10g Application Server 10.1.0.2
Oracle Oracle9i Application Server 9.2.0.7
Oracle Oracle9i Application Server 9.2.0.6
Oracle Oracle9i Application Server 9.0.3.1
Oracle Oracle9i Application Server 9.0.3
Oracle Oracle9i Application Server 9.0.2.3
Oracle Oracle9i Application Server 9.0.2.2
Oracle Oracle9i Application Server 9.0.2.1
Oracle Oracle9i Application Server 9.0.2.0.1
Oracle Oracle9i Application Server 9.0.2.0.0
Oracle Oracle9i Application Server 9.0.2
Oracle Oracle9i Application Server 1.0.2.2.2
Oracle Oracle9i Application Server 1.0.2.2
Oracle Oracle9i Application Server 1.0.2.1s
Oracle Oracle9i Application Server 1.0.2
Oracle HTTP Server 9.2.0
Oracle HTTP Server 9.1
Oracle HTTP Server 9.0.3.1
Oracle HTTP Server 9.0.2.3
Oracle HTTP Server 9.0.2.3
Oracle HTTP Server 9.0.2
Oracle HTTP Server 9.0.1
Oracle HTTP Server 8.1.7
Oracle HTTP Server 1.0.2.2 Roll up 2
Oracle HTTP Server 1.0.2.2
Oracle HTTP Server 1.0.2.1
Oracle HTTP Server 1.0.2.0
Description:
--------------------------------------------------------------------------------
Bugtraq id: 16384

Oracle Database is a large commercial Database system.

Oracle Database Component PL/SQL Gateway has a vulnerability in implementing the access control list. Attackers may exploit this vulnerability to completely control the data system.

Due to access control implementation problems, attackers may bypass the restriction on the PLSQLExclusion list to access the stored procedure that is denied by unauthorized access, so as to obtain the DBA permission of the database completely.

<* Source: David Litchfield (david@nextgenss.com)

Link: http://marc.theaimsgroup.com /? L = bugtraq & m = 113821380831850 & w = 2
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:

If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:

* Use mod_rewrite to filter malicious requests.

Add the following configuration items to the httpd. conf file:

RewriteEngine on
RewriteCond % {QUERY_STRING} ^. *). * |. * % 29. * $
RewriteRule ^. * $ http: // 127.0.0.1/denied.htm? Attempted-attack
RewriteRule ^. *). * |. * % 29. * $ http: // 127.0.0.1/denied.htm? Attempted-attack

Restart the Web server.

Vendor patch:

Oracle
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.oracle.com