SQL Injection Notes in Oracle Metalink (updated)

4 years ago I published an article about “Metalink Hacking“.

Today I was looking again in Metalink for the search string “SQL Injection” and I found 2 interesting notes in Oracle’s knowledge base.
———–
Doc ID:     455801.1 - Updated 29-Jan-2009
DBTableOraDataSourceLoginModule Based Custom Login Module Has Faulty SQL Injection Detection

Applies to:
Oracle Containers for J2EE - Version: 10.1.3.0.0 to 10.1.3.3.0
This problem can occur on any platform.
Users with the characters “OR”/”or” in their name are not able to connect to the database.

The note mentions also an unpublished bug
5645982 -  - AUTHENTICATION FAILS FOR USERNAME CONTAINING “OR”, “UPDATE”, “DELETE”, ETC.
Interesting approach from Oracle. Just filter all reserved words to avoid SQL Injection. To bad for me that ALEXANDER contains the reserved word AND  and KORNBRUST the reserved word OR. Double whammy…

The good news is that Oracle has a patch for this problem.

1. Download and apply Patch 5645982 to a 10.1.3.3 installation
2. Restart the OC4J instance

I recommend a blog entry “Can you spell…” from Oracle Guru Tom Kyte…

———–

Second finding in Metalink was an exploit in the CMS from Stellent (aka Oracle Universal Content Management), aquired by Oracle in 2007. Publishing exploits with customer URLs is a bad style…

———–

Note 733017.1  from October 2008 says:
Version 6.2 of the Content Server has an SQL injection vulnerability.

Oracle was so nice to publish the exploit pointing to a customer site.

Scurity consultant report states:

Severity: 5
Port: 80
Name: SQL injection
Description: “An SQL injection vulnerability was identified in the following page:
http://customer.site/****&dID=1%20and%20convert
(varchar.(select%20@@version))=1

The back-end version return was ‘Microsoft SQL Server 2000 -8′</blockquote>”

– Business Impact:
Potential security threat

Cause
This is a known bug/issue with 7.5 and prior. (internal bug p51038621)

———————————–

Good to know that SQL Injection is just a potential security threat…

UPDATE:
Oracle removed note 733017.1 from Metalink.

Dieser Eintrag wurde am 29 Jan 2009 um 21:21 verfasst und befindet sich in SQL Injection, Oracle Security. Sie können alle Antworten zu diesem Eintrag über den Feed RSS 2.0 mitverfolgen. Hinterlassen Sie eine Antwort oder einen Trackback-Link zu Ihrer eigenen Homepage.

| Drucken