Vuln Dev
Oracle 0-day to get SYSDBA access to the database Nov 12 2007 01:14PM
pete petefinnigan com
Tanel Poder has found a way to get SYSDBA access to the Oracle database by utilising a user who has the BECOME USER system privilege, execute privileges on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user with these privileges can become SYS (but not SYSDBA) and then use an immediate debug event to cause a debugger to flip the SYSDBA bit in the PGA to set a dedicated server session to an SYSDBA one, from there the user can do anything else. The user needs to have these privileges so its not an open and shut case but serious in that a privilege escalation is still possible. Tanels post is here http://blog.tanelpoder.com/2007/11/10/oracle-security-all-your-dbas-are-
sysdbas-and-can-have-full-os-access/ and my blog entry / analysis is here - http://www.petefinnigan.com/weblog/archives/00001126.htm

cheers

Pete

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus