Vulnerability in Oracle 11gR2 allows system privileges for all

At the recent Black Hat DC 2010 conference, British security expert David Litchfielddemonstrated vulnerabilities in Oracle's latest 11gR2 database release.Overgenerous privileges for Java procedures allow users to escalatetheir own privileges, up to the point of gaining complete control overthe database.

This is due to the fact that any user can execute the procedures contained in the DBMS_JVM_EXP_PERMS package, which is aimed at making it easier to update Oracle installations. In particular, users can use the IMPORT_JVM_PERMSprocedure to change their privileges in the Java policy table so thatthe JVM allows them to execute operating system commands and to readand write files.

This vulnerability alone does not allow a user lacking the relevantprivileges to carry out these operations – this is prevented byOracle's own system of privileges and roles. A second bug, however,allows users to adapt these privileges as required. The guiltyprocedure is DBMS_JAVA.SET_OUTPUT_TO_JAVA. This launchesa new Java VM with the privileges of the SYS user and starts byexecuting any SQL code passed to it with said privileges. Litchfieldhas demonstrated how, by using appropriate parameters when calling DBMS_JAVA.SET_OUTPUT_TO_JAVA,an unprivileged user is able to escalate to a fully-privileged DBAuser. Thanks to the changes previously made to the Java policy table,he is now able to execute operating system commands. Litchfieldillustrated this under Windows 7 by creating a new user to which hethen assigned administrator privileges.

He also demonstrated that it is possible to circumvent thedatabase's Label Security, for which Oracle has received EAL4certification under Common Criteria. Label Security is intended toensure that users are only able to see information intended for them.He demonstrated that vulnerabilities in the Java implementation allowarbitrary dynamic libraries to be loaded into the Oracle process. Thisgives them access to data which should be strictly locked down by LabelSecurity.

Litchfield reports that he informed Oracle of the vulnerabilitiesback in November. No patch has yet been forthcoming. As a workaround,he recommends removing the generous execution privileges of PUBLIC from the DBMS_JAVA, DBMS_JAVA_TEST and DBMS_JVM_EXP_PERMS packages.

Although video of Litchfield's talk was available from the Black Hat DC 2010 site, The H found that the video has since been removed.