Oracle 0-day to get SYSDBA access

[pete () petefinnigan com]

Tanel Poder has found a way to get SYSDBA access to the Oracle database by utilising a user who has the BECOME USER 
system privilege, execute privileges on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user with these 
privileges can become SYS (but not SYSDBA) and then use an immediate debug event to cause a debugger to flip the SYSDBA 
bit in the PGA to set a dedicated server session to an SYSDBA one, from there the user can do anything else. The user 
needs to have these privileges so its not an open and shut case but serious in that a privilege escalation is still 
possible. Tanels post is here 
http://blog.tanelpoder.com/2007/11/10/oracle-security-all-your-dbas-are-sysdbas-and-can-have-full-os-access/ and my 
blog entry / analysis is here - http://www.petefinnigan.com/weblog/archives/00001126.htm

cheers

Pete