Imperva has released an advisory for a bug that they have found in the TNS protocol that allows a user with no more than CREATE SESSION privileges to execute any SQL statement in the context of the SYS user. Imperva's advisory is titled "Security Advisory: Oracle DBMS – Critical Access Control Bypass in Login Bug
". This is a very interesting advisory that details how the O3Login process can be used to execute any SQL command. During the login process the first request (message code 0x73) contains only the username, the second request (message code 0x76) contains the username and an encrypted password. It also contains name-value pairs intended to set up session attributes. One of these is AUTH_ALTER_SESSION intended to set up language and locale. It can however be used to create a user and create DBA privileges for that account.
This is a very interesting bug described in this alert.