Oracle Database Two Security Issues

SA38353

CVE-2010-0866, CVE-2010-0867

08 Feb 2010

14 Apr 2010

Less Critical

Vendor Patch

Oracle Database 10.x
Oracle Database 11.x

From local network

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Privilege escalation

This covers vulnerabilities where a user is able to conduct certain tasks with the privileges of other users or administrative users.

This typically includes cases where a local user on a client or server system can gain access to the administrator or root account thus taking full control of the system.

David Litchfield has reported two security issues in Oracle Database, which can be exploited by malicious users to gain escalated privileges and compromise a vulnerable system.

1) Access to procedures within the "DBMS_JVM_EXP_PERMS" package is not restricted, which can be exploited to modify the Java policy table via the "IMPORT_JVM_PERMS" procedure.

This can be exploited to e.g. execute arbitrary operating system commands.

2) An error in the argument handling of the "DBMS_JAVA.SET_OUTPUT_TO_JAVA" procedure can be exploited to execute SQL commands as the SYS user.

This can be exploited to gain DBA user privileges.

NOTE: Successful exploitation allows bypassing Oracle Label Security.

Apply patches (please see the vendor's advisory for details).

David Litchfield

Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html
http://blogs.oracle.com/security/2010/04/april_2010_critical_patch_upda.html

https://media.blackhat.com/bh-dc-10/video/Litchfield_David/BlackHat-DC-2010-Litchfield-Oracle11g-video.m4v
http://www.databasesecurity.com/HackingAurora.pdf
http://www.databasesecurity.com/bh-DC2010.pdf