Shutdown TNS Listener via Oracle iSQL*Plus
##########################################


Name Shutdown TNS Listener via Oracle iSQL*Plus
Systems Affected Oracle Database 9i Rel. 2
Severity Medium Risk
Category Denial of Service
Vendor URL http://www.oracle.com
This advisory http://www.red-database-security.com..._shutdown.html
Author Alexander Kornbrust (ak at red-database-security.com)
Date 7 October 2005 (V 1.00)



Details
#######
Oracle iSQL*Plus is a web interface to SQL*Plus. The web interface can be used to stop the (unprotected) TNS Listener.


Affected Products
#################
Oracle Database 9i Release 2


Testcase
########
http://server:3339/isqlplus?username...cker%29%29%29&
login=Login&action=logon

==> ERROR:

ORA-12564: TNS:connection refused



Excerpt from the listener.log:

28-OCT-2003 15:14:39 * (CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)(USE R=Hacker)(CID=(PROGRAM=c:\oracle\ora92\bin\isqlplu s)(HOST=LOCALHOST)(USER=SYSTEM))) * stop * 0




Affected systems
################
Tested with Oracle Database 9.0.2.4.


Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle
forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005.

All already published alerts are available on the web site of Red-Database-Security GmbH
http://www.red-database-security.com...ed_alerts.html



History
#######
28-oct-2003 Oracle secalert was informed

29-oct-2003 Bug confirmed

12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security
that this bug is already fixed.

07-oct-2005 Red-Database-Security published this advisory


© 2005 by Red-Database-Security GmbH - last update 7-october-2005