Hello all, In our testing this bug can be exploited without a user ID and password. In fact I demonstrated exploit code for this vulnerability at the Blackhat Security Breifings in Amsterdam in the May of this year. [Normally I don't do such demonstrations unless a patch is available for a problem. Oracle had informed me a patch would be available in time, but I think they found some regression problems with the patches or something along those lines and were unable to release the patch. We initially informed Oracle about this issue around the end of September/start of October 2002.] So, to put the record straight, as far as NGSSoftware is concerned, this bug _can_ be exploited without a user ID and password. Oracle customers can either install the patch [Patch matrix available from http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf] Alternatively customers can disable external procedure functionality. To do this edit the listener.ora file, removing the entries for extproc, and also delete the extproc binary which can be found in $ORACLE_HOME/bin Thanks, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ ----- Original Message ----- From: "Tina Bird" <tbird@precision-guesswork.com> To: <bugtraq@securityfocus.com> Sent: Friday, July 25, 2003 8:59 PM Subject: question about oracle advisory > > Oracle's released three security-related patches today. I'm trying to > get my head around them to write up a Stanford Security Alert, but > there's conflicting information. According to > http://otn.oracle.com/deploy/security/pdf/2003alert57.pdf the buffer > overflow in the EXTPROC code can only be triggered by an authenticated > user with the CREATE LIBRARY or CREATE ANY LIBRARY privilege. > > According to the NGSSoftware advisory that announced the vulnerability, > the buffer overflow can be exploited without any authentication or > privilege-checking. > > Anyone have any ideas? > > thanks -- tbird > > -- > A computer lets you make more mistakes faster than any invention in human > history - with the possible exception of handguns and tequila. > > -- Mitch Ratliff > > http://www.precision-guesswork.com > Log Analysis http://www.loganalysis.org > VPN http://vpn.shmoo.com > tbird's Security Alerts http://securecomputing.stanford.edu/alert.html > >
