Oracle PL/SQL Gateway fails to properly validate HTTP requests

Overview

The Oracle PL/SQL Gateway fails to properly validate HTTP requests. This may allow a remote attacker to execute SQL commands on an Oracle database.

Description

Oracle uses the Oracle PL/SQL Gateway to access Oracle databases over HTTP. A lack of validation in the Oracle PL/SQL Gateway may allow a remote attacker to bypass Oracle’s security restrictions and gain access to critical packages and procedures. The Oracle PL/SQL Gateway uses a list of keywords to restrict access to powerful packages and procedures. Upon receiving a request to execute a procedure, the PL/SQL Gateway compares the request to the list to determine if that procedure attempts to access any restricted procedures or packages. However, a remote attacker may be able to bypass this check by sending a specially crafted HTTP request to the Oracle PL/SQL Gateway.

Note that all Oracle installations with the HTTP Server (Apache) enabled may be affected by this vulnerability. For more information see Oracle Metalink Note 311536.1.

According to public reports, this issue is identified as PLSQL01 in the Oracle Critical Patch Update for April 2006.

---

Impact

If a remote attacker sends a specially crafted HTTP request to a vulnerable Oracle installation, that attacker may be able to execute SQL commands with elevated privileges.

---

Solution

Apply a patch
This issue is corrected by the Oracle Critical Patch Update for April 2006.

---

Set always_describe or PlsqlAlwaysDescribeProcedure parameters to ON

Set the always_describe or PlsqlAlwaysDescribeProcedure to ON in the dads.conf file. According to red database security:

_PlsqlAlwaysDescribeProcedure specifies whether mod_plsql should describe a procedure before trying to execute it. If this is set to “On”, then mod_plsql will always describe a procedure before invoking it. Otherwise, mod_plsql will only describe a procedure when its internal heuristics have interpreted a parameter type incorrectly.

If PlsqlAlwaysDescribeProcedure is enabled, Oracle tries to describe every PL/SQL procedure. If a hacker injects pl/sql code, Oracle tries to describe this specially crafted string but fails because this procedure does not exist. _
Disable Oracle’s HTTP Server

As a general rule, disable or remove any nonessential software. In this case, the Oracle HTTP Server (Apache) should be disabled on any Oracle installations that do need to be accessible via HTTP.

Limit Access to HTTP Server

You may wish to block access to the vulnerable software from outside your network perimeter, specifically by blocking access to the ports used by the Apache HTTP server (typically 80/tcp). This will limit your exposure to attacks. However, blocking at the network perimeter would still allow attackers within the perimeter of your network to exploit the vulnerability. The use of host-based firewalls in addition to network-based firewalls can help restrict access to specific hosts within the network. It is important to understand your network’s configuration and service requirements before deciding what changes are appropriate.

---

Vendor Information

169164

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Oracle Corporation __ Affected

Updated: April 19, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Refer to <http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23169164 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html&gt;
• <https://metalink.oracle.com/&gt;
• <http://secunia.com/advisories/18621/&gt;
• <http://www.securityfocus.com/archive/1/423029&gt;
• <http://www.securityfocus.com/archive/1/archive/1/423819/100/0/threaded&gt;
• <http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041742.html&gt;
• <http://www.red-database-security.com/advisory/oracle_modplsql_injection.html&gt;
• <http://www.integrigy.com/info/IntegrigySecurityAnalysis-MODPLSQLVuln.pdf&gt;
• <http://www.red-database-security.com/advisory/oracle_cpu_apr_2006.html&gt;

Acknowledgements

This vulnerability was reported by David Litchfield of NGSSoftware. Information used in this document came from Integrigy, Alexander Kornbrust of red-database security, and Vladimir Zakharychev of Webrecruiter.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2006-0435
Severity Metric:	21.38 Date Public: