TUCoPS :: Unix :: General
:: oracle17.htm
Oracle listener program 7.3.4, 8.0.6, and 8.1.6 on all platforms execute arbitrary code
Vulnerability
Oracle
Affected
Oracle listener program 7.3.4, 8.0.6, and 8.1.6 on all platforms
Description
Following is based on a Internet Security Systems Security
Advisory. Internet Security Systems (ISS) X-Force has discovered
a vulnerability in the listener program in Oracle Enterprise
Server. It is possible for a remote attacker to gain access to
the Oracle owner operating system account and the Oracle
database, and to execute code in various operating systems.
The Oracle listener program accepts remote commands from remote
listener controllers. If configured properly, a password is
required to authenticate a user before issuing a listener command.
The default Oracle installation does not allow a password for the
listener program to be indicated. If a password has not been set,
the Oracle listener program can be configured to append log
information to a file. Due to a problem with the SET TRC_FILE and
SET LOG_FILE commands, these values can be changed to any file
name. This allows an attacker to create a new file or corrupt an
existing file.
The information logged by the listener program can be specified
by an attacker by sending a specially formed connect packet to the
listener. This logged information can be changed to include
commands and escape characters, allowing an attacker to gain
access to an operating system account.
This vulnerability was discovered and researched by Ben Layer and
Aaron Newman of Internet Security Systems.
Solution
Oracle recommends that customers download the patches for this
vulnerability from Oracle's Worldwide Support Services website
http://metalink.oracle.com. Customers can reference generic bug
number 1361722 filed against the listener program.
ISS SAFEsuite security assessment software, Database Scanner,
currently determines if a password is indicated for the listener
and how strong the password is. An upcoming release of Database
Scanner will be updated to determine if the Oracle patch has been
applied.