Re: question about oracle advisory

[Jeff Smith <jsmith () purdue edu>]

I can confirm that this is Oracle's stance.  I opened a TAR (technical
assistance request) to ask that they make the patch available for 8i,
which is supposed to receive error correction support until December 31,
2003.  Their reply, in summary, is:

1) Bug 2716764 was introduced in 9.2 and does not apply to 8i 

2) 9.2.0.3 requires patch 2988114 and 9.2.0.2.0 requires patch 2988086,
both of which address extproc buffer overflows, but apparently ones
specific to 9i versions.

3) The third bug, 2642203 (extproc buffer overflow possible on long
library name), does apply and already has a backport request in
progress.  According to the Oracle tech support person, you must have a
database account and the create library privilege to exploit the bug,
which is contrary to Mr. Litchfield's follow-up letter.

This confusing situation doesn't exactly reassure me!  A "repeat by"
that showed whether you were vulnerable would be helpful to many Oracle
DBAs.

Jeff Smith
IT Security & Policy
Purdue University


On Tue, 2003-08-05 at 13:40, McCartney, Daymon (US - Deerfield) wrote:
> David:
>
> Do you have any plans to release proof of concept code for the Oracle
> exploit?  The reason I ask is that "due to architectural constraints,"
> Oracle is not planning on releasing a patch for 8i releases.  We contacted
> them about this, but they're sticking to their guns about the exploit
> requiring oracle authentication, and thus being a low(er)-risk
> vulnerability.  
>
> To quote the analyst that responded, "I'm not able to comment on David
> Litchfield's claims, but with SECURITY ALERT 57, you need the CREATE LIBRARY
> or the CREATE ANY LIBRARY privilege. The exploit is dependent on these
> privileges, so if they are not granted to users, the exploit fails. How a
> user could exploit these without being able to connect is difficult to even
> imagine."
>
> I'd like to see them put out a patch for this, but without some more proof
> of the anonymous exploit, and motivation to fix the problem regardless of
> "architectural constraints", I don't think they will.  
>
> Regards,
>
> Daymon