NGSSoftware Insight Security Research Advisory

Name:    Oracle PL/SQL Apache Module
Systems Affected:  Oracle 9iAS
Platforms:  Sun SPARC Solaris 2.6
   MS Windows NT/2000 Server
   HP-UX 11.0/32-bit
Severity:  High Risk
Vendor URL:   http://www.oracle.com/
Author:   David Litchfield (david@nextgenss.com)
Date:   6th February 2002
Advisory number: #NISR06022002B
Advisory URL:  http://www.nextgenss.com/advisories/oramodplsbos.txt


Issue
*****
There are multiple buffer overflows in the PL/SQL module for Oracle
Application Server running on Apache web servers that allow the execution
of arbitary code. A non-overflow DoS also exists.

Description
***********
The web service with Oracle 9iAS is powered by Apache and provides many
application environments with which to offer services from the site. These
include SOAP, PL/SQL, XSQL and JSP. There are multiple buffer overrun
vulnerabilities in the PL/SQL Apache module that allow the execution of
arbitrary code.

Details
*******
The PL/SQL module exists to allow remote users to call procedures exported
by a PL/SQL package stored in the database server. This module can be
overflowed by making an overly long request to the plsql module; An overly
long password set in the Authorization HTTP client header; An overly long
cache directory name in the cache form; Setting an overly long password in
the adddad form;

Some of these attacks require that attacker know the name of the adminPath
whereas others do not.

All allow the execution of arbitrary code. On Windows NT/2000 systems the
Oracle Apache web server by default runs in the context of the local SYSTEM
account so any code will run with full privileges.


A further problem also exists whereby a request made to the pls module with
an HTTP client Authorization header set but with no auth type will cause the
server to access violate. The server needs to be restarted after an attack.


Fix Information
***************
NGSSoftware alerted Oracle to these problems between December 2001 and early
January 2002. Oracle has produced a patch to fix these problems and can be
downloaded from the Metalink site (http://metalink.oracle.com).