4 years ago I published an article about Metalink Hacking.
Today I was looking again in Metalink for the search string SQL Injection and I found 2 interesting notes in Oracles knowledge base.
Doc ID: 455801.1 – Updated 29-Jan-2009
DBTableOraDataSourceLoginModule Based Custom Login Module Has Faulty SQL Injection Detection
Applies to:
Oracle Containers for J2EE – Version: 10.1.3.0.0 to 10.1.3.3.0
This problem can occur on any platform.
Users with the characters OR/or in their name are not able to connect to the database.
The note mentions also an unpublished bug
5645982 – – AUTHENTICATION FAILS FOR USERNAME CONTAINING OR, UPDATE, DELETE, ETC.
Interesting approach from Oracle. Just filter all reserved words to avoid SQL Injection. To bad for me that ALEXANDER contains the reserved word AND and KORNBRUST the reserved word OR. Double whammy
The good news is that Oracle has a patch for this problem.
1. Download and apply Patch 5645982 to a 10.1.3.3 installation
2. Restart the OC4J instance
I recommend a blog entry Can you spell from Oracle Guru Tom Kyte
Second finding in Metalink was an exploit in the CMS from Stellent (aka Oracle Universal Content Management), aquired by Oracle in 2007. Publishing exploits with customer URLs is a bad style
Note 733017.1 from October 2008 says:
Version 6.2 of the Content Server has an SQL injection vulnerability.
Oracle was so nice to publish the exploit pointing to a customer site.
Scurity consultant report states:
Severity: 5
Port: 80
Name: SQL injection
Description: An SQL injection vulnerability was identified in the following page:
http://customer.site/****&dID=1%20and%20convert
(varchar.(select%20@@version))=1
The back-end version return was Microsoft SQL Server 2000 -8′</blockquote>
Business Impact:
Potential security threat
Cause
This is a known bug/issue with 7.5 and prior. (internal bug p51038621)
Good to know that SQL Injection is just a potential security threat
UPDATE:
Oracle removed note 733017.1 from Metalink.