|
|
| |
| The TNS Listener can be crashed by an attacker causing a Denial of Service; alternatively the attacker can use the same flaw to expose memory contents remotely. This may reveal sensitive information. |
| |
Credit:
The information has been provided by David Litchfield.
The original article can be found at:
http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-oracle-tns-listener/
|
| |
There is a bug in GIOP service that can allow an attacker to crash the TNS Listener and/or dump memory. A DWORD in the connect GIOP packet is trusted as the size of the data in the packet.
By setting this to a large value (e.g. 0 1FFFF) causes the listener to allocate this much memory then attempt to copy this much data to it - which eventually leads to a read access violation because the source data is less than this number and the process lands in uninitialized memory. If the attacker uses a smaller number, e.g. 0xFFFF they can dump this many bytes from memory.
This may reveal sensitive information such as the TNS Listener password.
Vendor Status:
Oracle was alerted to this flaw on the 22nd of June 2006. A patch has now been made available:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2007.html
|
|
|
|
|
|
|
|
