search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Oracle DBMS_EXPORT_EXTENSION package vulnerable to SQL injection

Vulnerability Note VU#932124

Original Release Date: 2006-05-03 | Last Revised: 2006-07-25

Overview

A vulnerability in Oracle PL/SQL Export Extensions may allow an attacker to modify privileged database information.

Description

Oracle Extensions, ODCIIndex Interface, and ODCIIndexGetMetadata

Oracle extensions are used to create customized Oracle database constructs. An indextype is an Oracle extension that allows users to create specialized indexes on an Oracle database. To create a new indextype, the ODCIIndex Interface must be implemented, meaning that certain methods specified in that interface must be defined. The ODCIIndexGetMetadata(...) routine is one such method in the ODCIIndex Interface. When the ODCIIndex Interface is implemented for a new indextype, the ODCIIndexGetMetadata(...)routine is used to specify how metadata for that indextype should be handled.

Oracle DBMS_EXPORT_EXTENSION

DBMS_EXPORT_EXTENSION is a built-in Oracle package used to import and export information in an Oracle Database. The DBMS_EXPORT_EXTENSION package implements the ODCIIndex Interface ODCIIndexGetMetadata(...) routine. Note that this package is owned by SYSDBA, but is accessible to the PUBLIC by default.

The Problem

The DBMS_EXPORT_EXTENSION package fails to properly sanitize user-controlled input. Specifically, if the GET_DOMAIN_INDEX_METADATA(...)routine is executed with the ODCIIndexGetMetadata(...)routine and attacker-supplied SQL commands, the SQL commands will be executed with SYSDBA privileges.

Based on research into public information, we believe that this issue is Oracle vuln# DB06 in the Oracle Critical Patch Update for July 2006.

Note that exploit code for this issue is publicly available.

Impact

A remote attacker with some authentication credentials may be able to execute arbitrary SQL statements with elevated privileges. This may allow the attacker to access and modify sensitive information within an Oracle database.

Solution

Apply Oracle CPU

Oracle has released the Oracle Critical Patch Update (CPU) for July 2006. It is unclear from the Oracle documentation whether this issue is addressed by this CPU. Public reports indicate that this issue has been addressed by this CPU, but this has not been confirmed.

Until a patch for this issue can be applied, the following actions may reduce the chances of exploitation:

Restrict access to Oracle

Only known and trusted users should be allowed access to Oracle. Additionally, user accounts should only be granted the fewest privileges needed to perform necessary tasks.

Change login credentials for default Oracle accounts

Oracle creates numerous default accounts when it is installed. Upon installation, accounts that are not needed should be disabled and the login credentials for needed accounts should be changed.

Vendor Information

932124
 
Expand all

Oracle Corporation Affected

Notified:  May 02, 2006 Updated: July 19, 2006

Status

Affected

Vendor Statement

There have been several public disclosures of vulnerabilities in the dbms_export_extension package. All of them, save one, are fixed in previous Critical Patch Updates. The most recent disclosure was irresponsibly published by a hacker as a "0day", meaning that there were no patches yet prepared for the issue. We have fixed this latest issue in our main code line, and are working on backports for all affected product versions and platforms. When these are completed, and all customers can obtain a patch for the vulnerability, we will release the patch in a Critical Patch Update.

Currently, there is no workaround that will not potentially affect product functionality. The dbms_export_extension package may be revoked from public, but we would caution that this configuration should be fully tested by customers before implementing in production.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

There may be multiple ways to access the DBMS_EXPORT_EXECUTE package. When testing for access to this package consider configurations such as user accounts and roles, besides PUBLIC, that have access to DBMS_EXPORT_EXECUTE and PL/SQL code that may call the DBMS_EXPORT_EXECUTE package with user influenced input.
Note that these are just two examples of configurations that may allow access to the DBMS_EXPORT_EXECUTE package, other access paths may exist.

Oracle has addressed this problem in the Oracle Critical Patch Update for July 2006: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2006.html.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was reported by David Litchfield of NGS Software.

This document was written by Jeff Gennari and Stephen Rhoton.

Other Information

CVE IDs: CVE-2006-3702
Severity Metric: 18.56
Date Public: 2006-04-26
Date First Published: 2006-05-03
Date Last Updated: 2006-07-25 19:04 UTC
Document Revision: 100

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis