Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "January 2006 Critical Patch Update Oracle security patch is released"] [Next entry: "Red Database Security has released 5 Oracle security bug advisories"]

Imperva discovers a critical access control bypass in login bug

Imperva has released an advisory for a bug that they have found in the TNS protocol that allows a user with no more than CREATE SESSION privileges to execute any SQL statement in the context of the SYS user. Imperva's advisory is titled "Security Advisory: Oracle DBMS Critical Access Control Bypass in Login Bug". This is a very interesting advisory that details how the O3Login process can be used to execute any SQL command. During the login process the first request (message code 0x73) contains only the username, the second request (message code 0x76) contains the username and an encrypted password. It also contains name-value pairs intended to set up session attributes. One of these is AUTH_ALTER_SESSION intended to set up language and locale. It can however be used to create a user and create DBA privileges for that account.

This is a very interesting bug described in this alert.