[Full-disclosure] [Argeniss] Oracle Database 10gR1 Buffer overflow in VERIFY_LOG procedure

Argeniss Security Advisory

Name: Oracle Database 10gR1 Buffer overflow in
VERIFY_LOG procedure (DB03)
Affected Software: Oracle Database Server version
10gR1
Severity: High
Remote exploitable: Yes (Authentication to Database
Server is needed)
Credits: Esteban Martinez Fayo
Date: 4/18/2006
Advisory Number: ARG040603

Details:
Oracle Database Server provides the DBMS_SNAPSHOT_UTL
package that includes capability to manage
materialized views.
This package contains the public procedure VERIFY_LOG
that is vulnerable to buffer overflow.

By default DBMS_SNAPSHOT_UTL has EXECUTE permission to
PUBLIC so any Oracle database user can exploit this
vulnerability.
Exploitation of this vulnerability allows an attacker
to execute arbitrary code. It can also be exploited to
cause DoS (Denial of Service) killing Oracle server
process.

Vendor Status:
Vendor was contacted and a Critical Patch Update was
released.

Workaround:
Restrict access to the DBMS_SNAPSHOT_UTL package (See
Links section).

Patch Available:
Although this security bug is addressed in the
Critical Patch Update April 2006, for most of the
affected platforms there are no patches available at
this moment.
Oracle informed that the missing patches would be
available on 01-May-06 !!!

Links:
http://www.argeniss.com/research/ARGENISS-ADV-040603.txt
http://www.argeniss.com/research/Workaround-ADV-040603.sql
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html

Spam:
Searching for Oracle 0days?
Argeniss Ultimate 0day Exploits Pack
http://www.argeniss.com/products.html

Argeniss - Information Security
Application Security Experts
http://www.argeniss.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/