Oracle utl_file server
directory vulnerability discovered
Pete Finnigan (www.petefinnigan.com)
has discovered an important vulnerability for Oracle database that
access directory-based objects (e.g. PL/SQL reads and writes to
files, BFILE object access):
CREATE OR REPLACE DIRECTORY mydir AS '/etc';
DECLARE
fHandler UTL_FILE.FILE_TYPE;
BEGIN
fHandler := UTL_FILE.FOPEN('MYDIR', 'myfile', 'w');
Exec UTL_FILE.PUTF(fHandler, 'We’re not in Kansas anymore, Toto\n');
UTL_FILE.FCLOSE(fHandler);
END;
/
http://www.petefinnigan.com/directory_traversal.pdf
Finnigan accesses the risks, offers a checking script, and points to
the MOSC patch:
Risk
Any existing DIRECTORY object that can be accessed presents a
potential risk. Read privileges on a DIRECTORY object are required
to exploit this issue.
Workaround
If no directory objects exist that can be accessed then the problem
can be minimised. Review existing directory objects and their access
privileges in the database. A good script is
http://www.petefinnigan.com/who_can_access.sql
which can be used to ascertain which users can access directory
objects. Revoke read access privileges from these objects and also
ensure no users have DIRECTORY object creation or alteration system
privileges.
Patch information
We advise customers of Oracle to apply the patches listed in the CPU
– January 2005 advisory as soon as possible. Please see MOSC
document ID 293737.1 at
|
