Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Oracle Critical Patch Update for Q1 2015 (Includes Java Updates) SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Oracle Critical Patch Update for Q1 2015 (Includes Java Updates)

Oracle released it's critical patch update. This quarter's CPU fixes a total of 169 vulnerabilities across the entire Oracle product portfolio. 

For end users, Java is probably the most important part of this update. This time around, 13 Java vulnerabilities are patched that allow remote code execution. 

None of the vulnerabilities in Oracle, the flagship database product, are remotely exploitable without authentication. But in particular one bug got some press as it exposes a rather simple configuration issues in Oracle's database allowing for privilege escalation within the database. 

Yesterday, we talked about privilege escalation in Linux. But similar problems exist in databases. Your end-user application (often a web application) should only connect back to the database using a user with carefully tailored permissions. However, all users need to have limited access to some system tables, for example to be able to find tables they have access to.

In this case, the table in question is called "DUAL". This table has only one column, and one value: "X". It's main function is to allow for syntactically correct SQL commands if values are selected that do not correspond to a particular table. For example, to write a SQL statement to retrieve the current date, you may write: SELECT sysdate FROM DUAL; "sysdate" isn't an actual column, but by using the DUAL table we can make this look like a normal SQL query.

Given this, the "DUAL" table doesn't really need any indexes. In particular since it only contains one value. Nevertheless, Oracle allows all users to create indexes on this table. For the non-oracle DBA, this may not sound that bad. But Oracle has a neat feature to use user defined functions to create indexes. This can lead to more efficient indexes if specific functions are used to query the table.

An attacker can now define a function that would give the attacker "DBA" privileges, and then ask the database to create an index using this function. By creating the index, the function that grants DBA privileges is executed.

[1] http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

I will be teaching next: Defending Web Applications Security Essentials - SANS San Francisco Spring 2020

Johannes

3693 Posts
ISC Handler
Is there a typo in your last paragraph? Is that supposed to say "can not" or "can now"?
Vincent T

14 Posts
fixed. thanks for noticing!
Johannes

3693 Posts
ISC Handler
Re: Java update
The disable Java link on the console security tab has disappeared. I've always disabled Java. How to do this in newest version?
Johannes
2 Posts
Are there any details about the circumstances of the Index on Dual vulnerability? When I try, I get:

create index asdasd on dual( dummy );
create index asdasd on dual( dummy )
*
ERROR at line 1:
ORA-01031: insufficient privileges
Johannes
1 Posts

Sign Up for Free or Log In to start participating in the conversation!