Oracle Database Server EXTPROC command execution
| oracle-extproc-command-execution (18662) |  High Risk |
Description:
Oracle10g and 9i Database Server could allow a local attacker to gain elevated privileges, caused by a vulnerability in the EXTPROC executable, which provides the functionality to allow procedure calls to external programs from PL/SQL. A local attacker could the bypass restriction that prevents extrpoc from accepting requests that are not from the Oracle database server and execute arbitrary commands on the server.
Platforms Affected:
- Oracle, Database Server 10.1.0.2
- Oracle, Database Server 9.0.1
- Oracle, Database Server 9.0.1.2
- Oracle, Database Server 9.0.1.3
- Oracle, Database Server 9.0.1.4
- Oracle, Database Server 9.0.1.5
- Oracle, Database Server 9.0.2
- Oracle, Database Server 9.0.2.4
- Oracle, Database Server 9.2
- Oracle, Database Server 9.2.0
- Oracle, Database Server 9.2.0.1
- Oracle, Database Server 9.2.0.2
- Oracle, Database Server 9.2.0.3
- Oracle, Database Server 9.2.0.5
- Oracle, Database Server 9.2.2
- Oracle, Database Server 9.2.3
Remedy:
Apply the appropriate patch for your system, available from the Oracle Security Alert #68. See References.
Consequences:
Gain Privileges
References:
- BugTraq Mailing List, Thu Dec 23 2004 - 10:33:51 CST, Oracle extproc local command execution (#NISR23122004C) at http://archives.neohapsis.com/archives/bugtraq/2004-12/0355.html.
- Oracle Security Alert #68, This security alert addresses security vulnerabilities in Oracle¿s server products. at http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf.
- BID-10871: Oracle Multiple Unspecified Vulnerabilities
- CVE-2004-1365: Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.
- CVE-2005-0297: SQL injection vulnerability in Oracle Database 9i and 10g allows remote attackers to execute arbitrary SQL commands and gain privileges.
- US-CERT VU#316206: Oracle Database Server contains several vulnerabilities
Reported:
Dec 25, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net