question about oracle advisory

[Tina Bird]

Oracle's released three security-related patches today. I'm trying to
get my head around them to write up a Stanford Security Alert, but
there's conflicting information. According to
http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf the buffer
overflow in the EXTPROC code can only be triggered by an authenticated
user with the CREATE LIBRARY or CREATE ANY LIBRARY privilege.

According to the NGSSoftware advisory that announced the vulnerability,
the buffer overflow can be exploited without any authentication or
privilege-checking.

Anyone have any ideas?

thanks -- tbird

--
A computer lets you make more mistakes faster than any invention in human
history - with the possible exception of handguns and tequila.

-- Mitch Ratliff

http://www.precision-guesswork.com
Log Analysis http://www.loganalysis.org
VPN http://vpn.shmoo.com
tbird's Security Alerts http://securecomputing.stanford.edu/alert.html

[David Litchfield]

Hello all,
In our testing this bug can be exploited without a user ID and password. In
fact I demonstrated exploit code for this vulnerability at the Blackhat
Security Breifings in Amsterdam in the May of this year. [Normally I don't
do such demonstrations unless a patch is available for a problem. Oracle had
informed me a patch would be available in time, but I think they found some
regression problems with the patches or something along those lines and were
unable to release the patch. We initially informed Oracle about this issue
around the end of September/start of October 2002.]

So, to put the record straight, as far as NGSSoftware is concerned, this bug
_can_ be exploited without a user ID and password.

Oracle customers can either install the patch [Patch matrix available from
http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf]
Alternatively customers can disable external procedure functionality. To do
this edit the listener.ora file, removing the entries for extproc, and also
delete the extproc binary which can be found in $ORACLE_HOME/bin

Thanks,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/








----- Original Message -----
From: "Tina Bird" <tbird@precision-guesswork.com>
To: <bugtraq@securityfocus.com>
Sent: Friday, July 25, 2003 8:59 PM
Subject: question about oracle advisory


>
> Oracle's released three security-related patches today. I'm trying to
> get my head around them to write up a Stanford Security Alert, but
> there's conflicting information. According to
> http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf the buffer
> overflow in the EXTPROC code can only be triggered by an authenticated
> user with the CREATE LIBRARY or CREATE ANY LIBRARY privilege.
>
> According to the NGSSoftware advisory that announced the vulnerability,
> the buffer overflow can be exploited without any authentication or
> privilege-checking.
>
> Anyone have any ideas?
>
> thanks -- tbird
>
> --
> A computer lets you make more mistakes faster than any invention in human
> history - with the possible exception of handguns and tequila.
>
> -- Mitch Ratliff
>
> http://www.precision-guesswork.com
> Log Analysis http://www.loganalysis.org
> VPN http://vpn.shmoo.com
> tbird's Security Alerts http://securecomputing.stanford.edu/alert.html
>
>

[McCartney, Daymon]

David:

Do you have any plans to release proof of concept code for the Oracle
exploit? The reason I ask is that "due to architectural constraints,"
Oracle is not planning on releasing a patch for 8i releases. We contacted
them about this, but they're sticking to their guns about the exploit
requiring oracle authentication, and thus being a low(er)-risk
vulnerability.

To quote the analyst that responded, "I'm not able to comment on David
Litchfield's claims, but with SECURITY ALERT 57, you need the CREATE LIBRARY
or the CREATE ANY LIBRARY privilege. The exploit is dependent on these
privileges, so if they are not granted to users, the exploit fails. How a
user could exploit these without being able to connect is difficult to even
imagine."

I'd like to see them put out a patch for this, but without some more proof
of the anonymous exploit, and motivation to fix the problem regardless of
"architectural constraints", I don't think they will.

Regards,

Daymon


----- Original Message -----
From: "David Litchfield" <david @ ngssoftware.com>
To: <bugtraq @ securityfocus.com>
Sent: Saturday, July 26, 2003 7:05 PM
Subject: question about oracle advisory

Hello all,
In our testing this bug can be exploited without a user ID and password. In
fact I demonstrated exploit code for this vulnerability at the Blackhat
Security Breifings in Amsterdam in the May of this year. [Normally I don't
do such demonstrations unless a patch is available for a problem. Oracle had

informed me a patch would be available in time, but I think they found some
regression problems with the patches or something along those lines and were

unable to release the patch. We initially informed Oracle about this issue
around the end of September/start of October 2002.]
So, to put the record straight, as far as NGSSoftware is concerned, this bug

_can_ be exploited without a user ID and password.
Oracle customers can either install the patch [Patch matrix available from
http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf]
Alternatively customers can disable external procedure functionality. To do
this edit the listener.ora file, removing the entries for extproc, and also
delete the extproc binary which can be found in $ORACLE_HOME/bin
Thanks,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/

- This message (including any attachments) contains confidential information
intended for a specific individual and purpose, and is protected by law. -
If you are not the intended recipient, you should delete this message and
are hereby notified that any disclosure, copying, or distribution of this
message, or the taking of any action based on it, is strictly prohibited.

[Jeff Smith]

I can confirm that this is Oracle's stance. I opened a TAR (technical
assistance request) to ask that they make the patch available for 8i,
which is supposed to receive error correction support until December 31,
2003. Their reply, in summary, is:

1) Bug 2716764 was introduced in 9.2 and does not apply to 8i

2) 9.2.0.3 requires patch 2988114 and 9.2.0.2.0 requires patch 2988086,
both of which address extproc buffer overflows, but apparently ones
specific to 9i versions.

3) The third bug, 2642203 (extproc buffer overflow possible on long
library name), does apply and already has a backport request in
progress. According to the Oracle tech support person, you must have a
database account and the create library privilege to exploit the bug,
which is contrary to Mr. Litchfield's follow-up letter.

This confusing situation doesn't exactly reassure me! A "repeat by"
that showed whether you were vulnerable would be helpful to many Oracle
DBAs.

Jeff Smith
IT Security & Policy
Purdue University


On Tue, 2003-08-05 at 13:40, McCartney, Daymon (US - Deerfield) wrote:
> David:
>
> Do you have any plans to release proof of concept code for the Oracle
> exploit? The reason I ask is that "due to architectural constraints,"
> Oracle is not planning on releasing a patch for 8i releases. We contacted
> them about this, but they're sticking to their guns about the exploit
> requiring oracle authentication, and thus being a low(er)-risk
> vulnerability.
>
> To quote the analyst that responded, "I'm not able to comment on David
> Litchfield's claims, but with SECURITY ALERT 57, you need the CREATE LIBRARY
> or the CREATE ANY LIBRARY privilege. The exploit is dependent on these
> privileges, so if they are not granted to users, the exploit fails. How a
> user could exploit these without being able to connect is difficult to even
> imagine."
>
> I'd like to see them put out a patch for this, but without some more proof
> of the anonymous exploit, and motivation to fix the problem regardless of
> "architectural constraints", I don't think they will.
>
> Regards,
>
> Daymon

[David Litchfield]

Hello Daymon and All,

I have CC'd in the Oracle Security Team....

> Do you have any plans to release proof of concept code for the Oracle
> exploit? The reason I ask is that "due to architectural constraints,"
> Oracle is not planning on releasing a patch for 8i releases. We contacted
> them about this, but they're sticking to their guns about the exploit
> requiring oracle authentication, and thus being a low(er)-risk
> vulnerability.

I know Oracle 9 is vulnerable and can be exploited without a user ID or
password. I demonstrated an exploit for this problem at the European
Blackhat Security Briefings. I know a number of the Oracle security guys
have actually read the associated paper and are (or at least should be)
_FULLY_ aware that this vulnerability _CAN_ be exploited without
credentials. Oracle: let me know if you need more proof of this and I can
send you the exploit.

As this new bug was introduced in the patch for the problem I reported
here - http://www.nextgenss.com/advisories/oraplsextproc.txt - and Oracle
will not give out patches to those who are not customers, I've never had the
opportunity to test this on 8.

At an educated guess, however, I believe 8 will be the same as 9.

> To quote the analyst that responded, "I'm not able to comment on David
> Litchfield's claims, but with SECURITY ALERT 57, you need the CREATE
LIBRARY
> or the CREATE ANY LIBRARY privilege. The exploit is dependent on these
> privileges, so if they are not granted to users, the exploit fails. How a
> user could exploit these without being able to connect is difficult to
even
> imagine."

The analyst should do more analysis then. It is really very simple.

>
> I'd like to see them put out a patch for this, but without some more proof
> of the anonymous exploit, and motivation to fix the problem regardless of
> "architectural constraints", I don't think they will.

I believe the Oracle security guys know this can be done without credentials
and if this is the case then it seems that one hand is not speaking to the
other. If however, the Oracle security guys believe this is not exploitable
without a userID and password then let me know. I'm more than happy to
supply Oracle with the exploit.

Can we get this resolved, once and for all, please.

Thank you,
David Litchfield