April 29, 2003, 3:27 PM — Oracle Corp. released a patch for a recently-discovered critical security vulnerability affecting its database servers.
The buffer overflow vulnerability affects all supported versions of Oracle database servers and could enable a remote attacker to compromise the data stored in Oracle and gain control over the machine hosting the database server, according to a security alert posted by Oracle. (See http://otn.oracle.com/deploy/security/pdf/2003alert54.pdf.) Affected versions include Oracle7 Release 7.3.x, all releases of Oracle8 and 8i and Release 1 and 2 of the Oracle 9i database.
On Friday, Oracle provided an interim or "one-off" patch for two versions of its 9i database and one version of its 8i database.
A patch for Oracle 8 database version 18.104.22.168 was available for customers with extended maintenance support, but the Redwood Shores, California, company said it had no plans to provide patches for earlier versions of its database.
Oracle encouraged customers running affected versions of its database software for which patches were available to apply the patch immediately.
The vulnerability exists in code responsible for handling Create Database Link queries, which enable one Oracle database to query information stored in another database, according to security company Next Generation Security Software Ltd. (NGSSoftware) of Sutton, U.K., which discovered the vulnerability.
Attackers can create an extra long value for the Oracle database link, then attempt to use that link, causing the buffer overflow. The buffer overflow can cause a denial of service to the Oracle database and, possibly, enable attackers to execute their own attack code on the database machine, NGSSoftware said.
The Create Database Link privilege is enabled by default for the Connect role, which is a standard role assigned to almost every active Oracle account, enabling users to connect to databases. The privilege is enabled regardless of whether additional Oracle database servers exist on a network, according to NGSSoftware.
Organizations that are unable to apply the patch can protect themselves by removing the Create Database Link privilege from the Connect role. However, a careful study should first be done of the affect such a move may have on applications that use the Oracle database, Litchfield said.
In its alert, Oracle said that the vulnerability was unlikely to be exploited remotely, except in cases where the Oracle database was connected directly to the Internet, without the protection of a firewall or application server.