Oracle provides a tool called the Listener Control utility (lsnrctl) to allow an Oracle DBA to remotely control the Listener. The Listener is responsible for dealing with client requests for database services. This control utility contains an indirect remotely exploitable format string vulnerability.
Vulnerable systems:
* Oracle 9i, 8i on all platforms
By default, the Oracle Listener is not protected against unauthenticated access and control. The configuration files of Listeners in such a state can be modified without the user needing to supply a password. By modifying certain entries in the listener.ora file, by inserting a format string exploit, an attacker can gain control of a Listener control utility. Typically an attack would require the attacker to modify the file and wait for an Oracle DBA to use the Listener control utility to access the Listener at which point control over the utility's path of execution can be gained. This will give the attacker the ability only to gain control of the DBA's machine and not the database server. This is a complex attack and requires certain "events" to happen and as such, the risk is quite low. That said, Oracle users are urged to apply the patch.
Fix Information:
NGSSoftware alerted Oracle to this problem on 13 May 2002. Oracle have produced a patch and issued an alert. Please see their bulletin for more details.
