Title: Oracle 9I Application Server PL/SQL Apache Module Buffer Overflow Vulnerability
Severity: CRITICAL
Description:
Oracle 9i Application Server comes with an Apache-based web server and support for environments such as SOAP, PL/SQL, XSQL and JSP.
The PL/SQL Apache module for Oracle 9iAS provides functionality for remote
administration of the Database Access Descriptors and access to help pages.
A remotely exploitable buffer overflow exists in the PL/SQL Apache module. This is due to a lack of bounds checking on certain types of user-supplied input.
A request for an excessively long help page can cause stack variables to be overwritten. As a result, the return address can be overwritten with attacker-supplied values, allowing for arbitrary code execution. Specifically, maliciously overwriting the return address with an address that contains a "call esp" or "jmp esp" instruction may be sufficient to allow the attacker to provide instructions that will be executed with the privileges of the Apache process.
On Microsoft Windows NT/2000 systems this may mean that the attacker-supplied code is executed with SYSTEM level privileges, as this is the privilege level that the Apache process runs under. On other operating systems successful exploitation may merit local interactive access for the attacker.
It should be noted that when a web user tries to access an /admin_/ page, the user will receive a challenge for authentication via a username/password prompt. However, no such challenge is issued when a web user attempts to access help pages.
This issue may also be exploited to cause a crude denial of service attack.
Affected Products:
- Oracle Oracle9i Application Server
References:
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
