7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.032 Low
EPSS
Percentile
91.1%
A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). An HTTP Authorization header with a crafted password parameter could allow an unauthenticated remote attacker to cause a denial of service or execute arbitrary code with the privileges of the Apache service.
NGSSoftware has released Insight Security Research Advisory #NISR06022002B that describes a number of vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). This document addresses a buffer overflow vulnerability caused by a malformed HTTP Authorization request.
Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module handles authentication requests for various elements of Oracle iAS, such as stored procedures and Database Access Descriptors (DAD). If necessary, the PL/SQL module will prompt for credentials using the Authorization mechanism of the HTTP protocol. Section 14.8 of RFC 2616 describes HTTP Authorization and RFC 2617 describes the Basic and Digest HTTP Authentication schemes. A malformed HTTP Authorization request that contains a crafted password parameter could trigger a buffer overflow, executing arbitrary code with the privileges of the Apache service.
The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.
An unauthenticated, remote attacker could cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an attacker may be able to gain complete control of the system.
Apply Patch
Apply the appropriate patch referenced in Oracle Security Alert #28.
Disable Vulnerable Service
Disable the vulnerable service (modplsql or mod_plsql in Apache).
Block or Restrict Access
Monitor and/or restrict access to the Apache service (typically 80/tcp). It may be possible to use TCP Wrapper or similar technology to provide improved access control and logging. Additionally, an application-level firewall may be able to filter requests made to Apache. Note that these workarounds are designed to limit access and detect exploit attempts. These workarounds do not prevent exploitation of this vulnerability.
878603
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: March 03, 2002 Updated: March 05, 2002
Affected
Oracle has released Oracle Security Alert #28.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23878603 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
The CERT Coordination Center thanks David Litchfield of NGSSoftware for information used in this document.
This document was written by Art Manion.
CVE IDs: | CVE-2002-0559 |
---|---|
Severity Metric: | 7.18 Date Public: |