Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam™  Beyond Security®  SecuriTeam™ Home  Ask the Team  Mailing Lists  Advertising Info  Blogs  Black Box Testing  Vulnerability Assessment  Vulnerability Scanner SecuriTeam™ in Your Inbox   E-mail this article to a friend New vulnerability? New tool? Tell us	Oracle RDBMS Data packet DoS 23 Oct. 2007    Summary The Oracle RDBMS upon receiving an invalid TNS data packet will use 100% of the CPU's time introducing a Denial of Service condition.   Credit: The information has been provided by David Litchfield. The original article can be found at: http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-oracle-rdbms/    Details Audit your web server for security holes - see what the hackers see. Sign up for a scan today - risk free! Vulnerable Systems:  * Oracle version 8.1.7.4  * Oracle version 9  * Oracle version 10g Release 2 and 1 Once a client connects to the database process and performs protocol negoation (TNS packet type 1) and data type represenations (packet type 2) it may then send packets of type 6 - Data packets. If the server gets a packet with the 2nd bit of the Data flags is set then the server runs at 100% CPU: \x00\x1D // Packet Size \x00\x00 // Packet Checksum \x06 // Packet Type [DATA] \x00 // Flags \x00\x00 // Header Checksum \x00\x02 // Data flags \x03\x3B // TTI Version function .. .. The snippet of a packet above sets the Data flags to 0 0002 on a version request. This DoS condition can be triggered prior to authentication. This can be exploited by an unauthenticated attacker. Vendor Status: Oracle was alerted to this flaw on the 23rd of June 2006. A patch has now been made available: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2007.html  Comments: Subject:   Date:  From:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Cisco BBSM Captive Portal Cross-site Scripting Cisco Unified Communications Manager Denial of Service Vulnerabilities Novell eDirectory Unauthenticated Access to SOAP Interface Call of Duty Denial of Service Wonderware SuiteLink Denial of Service Vulnerability WebMod Multiple Vulnerabilities IAX2 Incomplete 3-Way Handshake (Spoofing) Multiple Vendor OpenOffice Vulnerabilities Apple Safari WebKit PCRE Handling Integer Overflow Vulnerability Cisco Network Admission Control Shared Secret Vulnerability ClamAV libclamav PeSpin Heap Overflow Vulnerability ClamAV libclamav PE WWPack Heap Overflow Vulnerability IBM Informix Pre-Authentication Stack Overflow Adobe Flash Player DeclareFunction2 Invalid Object Use Vulnerability HP OpenView NNM Buffer Overflow  Featured Articles Microsoft Windows I2O Filter Utility Driver (i2omgmt.sys) Local Privilege Escalation Vulnerability Adobe Acrobat Javascript PDF Security Feature Bypass and Memory Corruption Vulnerabilities Multiple Vendor rdesktop Vulnerabilities Wonderware SuiteLink Denial of Service Vulnerability PHP Multibyte Shell Command Escaping Bypass Vulnerability Akamai Download Manager Arbitrary Program Execution Vulnerability SugarCRM Community Edition Local File Disclosure Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®