Overview
A vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). By specifying the Database Access Descriptor (DAD) used to access a PL/SQL application, an attacker could gain unauthorized access to the application.
Description
NGSSoftware has released a paper titled Hackproofing Oracle Application Server that describes a number of security issues in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses the DAD substitution problem, where an attacker could bypass authentication by specifying which DAD to use to access a PL/SQL application. Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. A DAD defines how a PL/SQL request connects to an application and is identified in the URL. For example: http://ias-server/pls/DAD/application.procedure?parameter A DAD can specify the credentials used to access an application, which may effectively grant anonymous (PUBLIC) access. If a DAD does not specify credentials, Apache will prompt the user and pass the credentials to the application using the PL/SQL module. Since the DAD is specified in the URL, an attacker can choose which DAD is used to access a particular application. By choosing a DAD that contains valid credentials, an attacker may be able to gain access to an application without being properly authenticated. In the case where one DAD provides PUBLIC access to one application and another DAD requires authentication for another application in the same database schema, an attacker can specify the PUBLIC DAD and gain unauthenticated access to the protected application. |
Impact
An unauthenticated remote attacker could gain access to an Oracle PL/SQL application. Depending on the capabilities of the application, the attacker could read, modify, or delete data. |
Solution
Block or Restrict Access |
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.
This document was written by Art Manion.
Other Information
| CVE IDs: | None |
| Severity Metric: | 5.94 |
| Date Public: | 2002-01-10 |
| Date First Published: | 2002-03-01 |
| Date Last Updated: | 2002-03-15 20:20 UTC |
| Document Revision: | 41 |