Calendar
Mai 2007
M D M D F S S
    Jun »
 123456
78910111213
14151617181920
21222324252627
28293031  
Kategorien
Letzte Einträge
Links
Archive
Meta
« Aaron Newman criticize Oracle patch policies | Mary Ann Davidson: Applications will have to defend themselves from attacks »

Oracle Security Riddle

During Oracle security audits we find from time to time the following (unsecure) code. Do you see the vulnerability and do you know how to exploit it?

Solution coming soon…
———-Code without exception handling—

FUNCTION CHGPWD (
P_USER VARCHAR2,
P_PWD VARCHAR2)
RETURN BOOLEAN IS

L_STMT VARCHAR2(255);

BEGIN

L_STMT:= ‘ALTER USER “‘ || P_USER || ‘” IDENTIFIED BY “‘ || P_PWD||’”‘;

EXECUTE IMMEDIATE L_STMT;

RETURN TRUE;

END;

Dieser Eintrag wurde am 28 Mai 2007 um 21:19 verfasst und befindet sich in source code audit, Oracle Security. Sie können alle Antworten zu diesem Eintrag über den Feed RSS 2.0 mitverfolgen. Hinterlassen Sie eine Antwort oder einen Trackback-Link zu Ihrer eigenen Homepage.

1 Antwort auf “Oracle Security Riddle”

  1. Gary sagt:
    29 Mai 2007 bei 01:56

    Well it isn’t invoker rights so the privileges it runs with might allow it to alter any user’s password (and presumably do, otherwise why not have the routine just derive the current user). I would generally think that is enough, but a suitably crafted P_USER (including closing quotes and a — comment) could allow it do other ALTER USER operations, such as Account unlock.
    Being pedantic, it would actually error as it’s not returning a true/false as indicated, but the error wouldn’t prevent the ALTER USER from happening. If this was really ‘live’, then it probably means either the errors are trapped and hidden or that it generates so many errors that they are never looked at. Either way any cracker’s attempt to abuse the routine would never be noticed.

    AK> sorry I forgot to copy the error handling and return value.

Antwort schreiben

Sie müssen als angemeldet sein, um einen Kommentar schreiben zu können.