|
Brought to you by:
Suppliers of:
|
|
|
| |
| An SQL injection vulnerability was found in the Oracle Database Server through the abuse of parameters in the DRILOAD package. |
| |
Credit:
The information has been provided by Kornbrust, Alexander - Red Database Security.
The original article can be found at: http://www.red-database-security.com/advisory/advisory_20040903_1.htm
|
| |
Vulnerable Systems:
* Oracle Database Server 8i (All platforms)
* Oracle Database Server 9i (All platforms)
Immune Systems:
* Oracle Database Server 10g
The vulnerability allows any valid database user to gain DBA rights over the database if CTXSYS is installed, by executing the DRILOAD package using a specially crafted parameter passed to it.
Workaround
The following workarounds are possible for vulnerable versions of Oracle:
* Drop the CTXSYS user if it's not needed.
* Revoke public grant from CTXSYS.DRILOAD and limit access to it by allowing trusted users only.
Patch Availability:
Please see MetaLink Document ID 281189.1 for the patch download procedures and for the Patch Availability Matrix for this Oracle Security Alert which can be found at:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=281189.1
Disclosure Timeline
5 Januar 2004 Oracle was informed
6 Januar 2004 Bug confirmed
31 August 2004 Oracle published alert 68
|
|
|
|
|
