Security researchers have found two serious buffer overruns in Oracle Corp. products, both of which give an attacker complete control of a vulnerable machine.
One flaw affects Windows machines running any version of Oracle9i, while the other affects any machine running the 9i Application Server, according to a bulletin released by Next Generation Security Software Ltd.
The Oracle Net Listener process in 9i contains a remotely exploitable buffer overrun flaw that when successfully exploited gives an attacker the ability to run whatever code he chooses. The Listener monitors TCP port 1521 for client requests to use the 9i database. When a request comes in, the process passes it to the database.
Such requests are passed in Transparent Network Substrate packets, which include a “service_name” parameter. If an attacker supplies an overly long value for this parameter when forming an error message to be written in the log file, the value overwrites a return address on the stack.
Any code that the attacker runs on the exploited machine will run in the local system context by default on Windows machines, the NGSS alert says. And because the overrun happens before the error message is written to the log file, it may be difficult to detect a successful attack.
The second flaw is a buffer overrun vulnerability in the Report Server component of the 9i Application Server. If an attacker sent an overly long database name parameter to the rwcgi60 program using the “setauth” method, he could overrun the buffer and gain control of the processs execution.
On Windows machines, the attackers code would run in the local system context by default, the bulletin says.
Oracle, of Redwood Shores, Calif., has released patches for the flaws, which are available through its Metalink service.
Related stories:
- Oracle11i Still Bugging Users
- Oracle9i Security Flaws Revealed
- Commentary: Oracles Secure, but Rest of World Isnt
- AppDetective on Case to Find Oracle Vulnerabilities
- More Security Coverage