Staying on top of Oracle's holes

Security Focus ^ | Feb 28 2002 8:51AM PT | By Thomas C. Greene, The Register

[Dominic Harr]

Staying on top of Oracle's holes

By Thomas C. Greene, The Register
Feb 28 2002 8:51AM PT

In light of the fortnight-old SNMP pandemic, it's tempting to forget that the world's most popular database kit remains vulnerable to a host of potential exploits which were published about three weeks ago by NGSSoftware Insight researcher David Litchfield.

Because SNMP holes can affect virtually any networked device, admins struggling to secure their systems may well have been distracted from the quite serious vulnerabilities Litchfield discovered.

And on top of the SNMP distraction, we note that Oracle has been less than eager to disseminate useful information about these issues, most likely because they illustrate the essential fatuity of its 'unbreakable' ad campaign.

With this in mind, Counterpane Internet Security held a teleconference for its clients Wednesday to remind them of lingering obstacles to running Larry Ellison's unbreakable product with a modicum of security.

Unresolved
According to Counterpane, the worst unresolved issue is the fact that the Oracle server will respond to external procedure calls, say from a custom application, with access to OS-level libraries and functions. Users are supposed to be authenticated with the proper level of access before executing code, but unfortunately aren't. There is in fact no user authentication at this level, Litchfield discovered.

Anyone can run an application at the OS level on a Windows installation. On Solaris, this depends on the user's account privileges, though it's safe to assume that too many users have more privileges than they need on most systems out there.

"If you're running Oracle on a Windows system, the default installation is that Oracle runs in the system [root] environment, and that means that basically anyone who has access to the network functionality has the ability to run local applications and functions as an administrator," Counterpane's Tina Bird warned.

Worse, "the procedure calls look exactly the same as all the other authorized procedure call in your database system," she added. "People exploiting those vulnerabilities are going to look just like the rest of the authorized traffic."

We'll note that a vulnerability in the PL/SQL DADs (Database Access Descriptors) can enable an attacker to escalate his privileges regardless of his initial status, so this is not an issue to be trifled with. Unfortunately Oracle has not yet released a patch. According to Bird, developing one will require considerable re-jiggering of the code which handles this interaction, so no one should hold his breath waiting for one.

For a bit of good news, Oracle has issued patches for buffer overflow vulnerabilities on Solaris and Windows, but these need to be approached with caution. Data integrity is of course crucial to all admins, but to database administrators it's a sacred mission. Thus it's necessary to test any Oracle patch thoroughly and meticulously before integrating it into a 'live' system. You may have custom apps or customized architecture, and you know how patches can be in these situations. Remember, a workaround may be nearly as effective, and a good deal safer, than a patch on some systems. Don't find out the hard way that your kit is 'a bit out of spec'.

Workarounds
Oracle recommends disabling db functionality which enables external processes. If that's impossible, then according to Counterpane, you can configure the Oracle listener to prevent all but a select few IP addresses from connecting. Additionally, you might block port tcp/1521 if you can get away with it.

To harden Oracle-9iAS against PL/SQL authentication bypassing it's possible to add the rule:
exclusion_list= account*, sys.*, dbms_*, owa*
to the file:
$ORACLE_HOME$\Apache\modplsql\cfg\wdbsvr.app

To work around the PL/SQL DAD vulnerability, change the AdminPath entry in:
$ORACLE_HOME$\Apache\modplsql\cfg\wdbsvr.app
to a path name that conceals the location of the admin pages.

A problem with OracleJSP which leaves potentially sensitive temporary files and page source readable by the public is described in detail, along with its workarounds, here. This involves modifications to Apache, and is not difficult. It's also very unlikely to break anything else.

You may also be able to set up a less-privileged or non-privileged environment for your Oracle server to run in. Do it if you can.

The most readable and detailed document on workarounds doesn't come from Oracle, sadly, but is instead Litchfield's paper. No one administering an Oracle database can afford to ignore it.


© 2000 - 2001 Situation Publishing Ltd. All rights reserved.

[Dominic Harr]

"Unbreakable", indeed. Isn't that marketing claim direct fraud?

Just FYI. Keep these folks' feet to the fire. They charge enough for their software, I think consumers have a right to expect the stuff to be secure!

[Dominic Harr]

.

[Texaggie79]

[Bush2000]

What bothers me about your constant haranguing is that it denies this basic reality: It's inevitable that software products have bugs.

[Bush2000]

A problem with OracleJSP which leaves potentially sensitive temporary files and page source readable by the public is described in detail, along with its workarounds, here. This involves modifications to Apache, and is not difficult. It's also very unlikely to break anything else.

I especially liked this one, Harr.

[dwollmann]

Read the details. It requires a few changes to httpd.conf, not Apache itself. For what it's worth, these changes wouldn't be necessary if the files were stored above the document root where they belong.

[Dominic Harr]

It's inevitable that software products have bugs.

Just like it was 'inevitable' that American autos would break down back in the 80s.

The American software industry is where the American auto industry was 30 years ago.

Americas best selling software is about as high a quality as America's best selling music (Britney Spears, etc) and America's best selling food (McDonalds, etc) and America's best selling news agencies . . .

[Bush2000]

Just like it was 'inevitable' that American autos would break down back in the 80s. The American software industry is where the American auto industry was 30 years ago.

Rrrrright, Harr. Cars don't break down anymore. They're flawless. They operate without any defects whatsoever... </sarcasm>

[dwollmann]

Evidently you didn't have the dubious pleasure of owning a new American-made car in the late 70s or early 80s. :)

[Bush2000]

Evidently you didn't have the dubious pleasure of owning a new American-made car in the late 70s or early 80s. :)

Actually, I did. Several. I'm just not deluded enough to expect perfection in any product.

[Bush2000]

Read the details. It requires a few changes to httpd.conf, not Apache itself. For what it's worth, these changes wouldn't be necessary if the files were stored above the document root where they belong.

More hypocrisy. If this had been MS, you all would be screaming bloody murder...

[upchuck]

Larry Ellison... the world's most arrogant person.
Well, except for THE SCUMBAG X42... peas in a pod they are.

[dwollmann]

Pointing out your mistake and explaining the issue is hypocrisy?

[Bush2000]

Pointing out your mistake and explaining the issue is hypocrisy?

Give it a rest: You and your Mac/Linux buddies have used this kind of nonsense to pillory MS mercilessly in the past. All products -- cars, software, airplanes, etc -- have bugs. Deal with it.

[dwollmann]

You seem incapable of conducting a civil discussion with anyone who doesn't mirror your views.

[Bush2000]

You seem incapable of conducting a civil discussion with anyone who doesn't mirror your views.

What's civil about hypocrisy?

[Incorrigible]

Ooopsy!

[Bush2000]

I won't be content until Larry Ellison is bumming smokes at a Silicon Valley soup kitchen ...