[Full-disclosure] [AppSecInc Team SHATTER Security Advisory] Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUBSCRIBE packages
shatter at appsecinc.com
Mon Apr 18 20:03:12 BST 2005
-----BEGIN PGP SIGNED MESSAGE-----
Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and
AppSecInc Team SHATTER Security Advisory
April 18, 2005
Affected Versions: Oracle Database Server version 10g
Risk level: High
Credits: This vulnerability was discovered and researched by Esteban
Martínez Fayó of Argeniss for Application Security Inc.
The SUBSCRIPTION_NAME parameter -- used in various procedures of
SYS.DBMS_CDC_SUBSCRIBE and SYS.DBMS_CDC_ISUBSCRIBE packages -- is
vulnerable to SQL injection. These packages execute with privileges of
the SYS user; by default, PUBLIC has EXECUTE privilege.
Any low privileged database user can execute functions with DBA
privileges. Users with privilges to create or modify a function can
inject a user-defined function in the vulnerable procedure and thus
execute SQL statements with DBA privileges.
Revoke Execute privilege on the vulnerable packages.
Vendor was contacted and a patch was released.
Apply Oracle Critical Patch Update April 2005 available at
Application Security, Inc advisory:
Oracle security alert:
Advanced SQL Injection in Oracle databases presentation:
Application Security, Inc.
AppSecInc is the leading provider of database security solutions for the
enterprise. AppSecInc products proactively secure enterprise
applications at more than 300 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with customers,
partners and suppliers. Our security experts, combined with our strong
support team, deliver up-to-date application safeguards that minimize
risk and eliminate its impact on business.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
-----END PGP SIGNATURE-----
Full-Disclosure is hosted and sponsored by Secunia.