Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via Database Access Descriptor password

Overview

A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). Specifying a crafted password for a Database Access Descriptor (DAD) could cause a denial of service or execute arbitrary code with the privileges of the Apache service.

Description

NGSSoftware has released Insight Security Research Advisory #NISR06022002B that describes a number of vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a buffer overflow vulnerability caused by a crafted DAD password entered in the PL/SQL gateway configuration page.

Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with a database and generate HTML that can be interpreted by a web browser. A DAD specifies how a PL/SQL request connects to a database application. The PL/SQL module provides a web-based administration interface to add and configure DADs. When creating a new DAD, specifying a malformed password in the configuration form could trigger a buffer overflow, executing arbitrary code with the privileges of the Apache service. In the default configuration, the administration pages are available to anyone who is able to access to the web server [VU#611776].

The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.

---

Impact

An unauthenticated remote attacker could cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an attacker may be able to gain complete control of the system.

---

Solution

Apply Patch
Apply the appropriate patch referenced in Oracle Security Alert #28.

---

Block or Restrict Access

Monitor and/or restrict access to the Apache HTTP service (typically 80/tcp). It may be possible to use TCP Wrapper or similar technology to provide improved access control and logging. Additionally, an application-level firewall or Intrusion Detection System (IDS) may be able to filter requests made to Apache.

Access to the PL/SQL gateway administration web pages can be restricted by specifying authorized user names and connect strings or an administrative Database Access Descriptor (DAD) in the PL/SQL gateway configuration file, /Apache/modplsql/cfg/wdbsvr.app. For more information, read the section titled Using the PL/SQL Gateway in the Oracle iAS documentation for the Oracle HTTP Server powered by Apache.

Note that these workarounds are designed to limit access and detect exploit attempts. These workarounds do not prevent exploitation of this vulnerability.

Disable Vulnerable Service

Disable the PL/SQL service (modplsql or mod_plsql in Apache).

---

Vendor Information

659043

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Oracle __ Affected

Notified: March 03, 2002 Updated: March 05, 2002

Status

Affected

Vendor Statement

Oracle has released Oracle Security Alert #28.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23659043 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.nextgenss.com/advisories/oraplsbos.txt&gt;
• <http://www.nextgenss.com/papers/hpoas.pdf&gt;
• <http://www.securityfocus.com/bid/4032&gt;
• <http://otn.oracle.com/deploy/security/pdf/ias_modplsql_alert.pdf&gt;
• <http://otn.oracle.com/tech/pl_sql/content.html&gt;
• <http://metalink.oracle.com/&gt;

Acknowledgements

The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.

This document was written by Art Manion.

Other Information

CVE IDs:	CVE-2002-0559
Severity Metric:	4.31 Date Public: