[Previous entry: "January 2006 Critical Patch Update Oracle security patch is released"] [Next entry: "Red Database Security has released 5 Oracle security bug advisories"]
Imperva discovers a critical access control bypass in login bug
January 17th, 2006 by Pete
Post to del.icio.us
Post to Furl
Imperva has released an advisory for a bug that they have found in the TNS protocol that allows a user with no more than CREATE SESSION privileges to execute any SQL statement in the context of the SYS user. Imperva's advisory is titled "Security Advisory: Oracle DBMS – Critical Access Control Bypass in Login Bug". This is a very interesting advisory that details how the O3Login process can be used to execute any SQL command. During the login process the first request (message code 0x73) contains only the username, the second request (message code 0x76) contains the username and an encrypted password. It also contains name-value pairs intended to set up session attributes. One of these is AUTH_ALTER_SESSION intended to set up language and locale. It can however be used to create a user and create DBA privileges for that account.
This is a very interesting bug described in this alert.
