Pete Finnigan's Oracle Security Weblog

Thanks to Aaron Newman of Application Security Inc for emailing myself and Alex to let us know about the new variant of the Oracle voyager worm that has been released to the wild. An anonymous poster has posted a new version of the original code to the Full Disclosure list in a post titled "Oracle - by kwbbwi - Utility to backup you Oracle Password Hashes". I have not looked in detail yet at what it does as I have just seen Aarons email. I have skimmed through and it starts by using the CTXSYS.DRILOAD bug to grant DBA to public!, not good. It has a google search string at the top that looks like it is installing a logon trigger that executes a google query that redirects to a “feeling lucky” site. I just tried the URL and search using IE and it gave me a google error that says (Probably not bright to try it manually but it looks like it should not cause any damage as a search string on its own):

"We're sorry...
... but we can't process your request right now. A computer virus or spyware application is sending us automated requests, and it appears that your computer or network has been infected."

It goes on to suggest that my connection will be restored and to use a spyware and virus checker. The PL/SQL virus at first sight looks like it has had an effect on the web already and that Google is recognising the HTTP request as a virus. There is no indication if this thing is in the wild or if Google have just been prudent.

I will have a better look through the code in a minute.