Vulnerability in Oracle 11gR2 allows system privileges for all

At the recent Black Hat DC 2010 conference
, British security expert David Litchfield
demonstrated vulnerabilities in Oracle's latest 11gR2 database release.
Overgenerous privileges for Java procedures allow users to escalate
their own privileges, up to the point of gaining complete control over
the database.

This is due to the fact that any user can execute the procedures contained in the

DBMS_JVM_EXP_PERMS

package, which is aimed at making it easier to update Oracle installations. In particular, users can use the

IMPORT_JVM_PERMS

procedure to change their privileges in the Java policy table so that
the JVM allows them to execute operating system commands and to read
and write files.

This vulnerability alone does not allow a user lacking the relevant
privileges to carry out these operations – this is prevented by
Oracle's own system of privileges and roles. A second bug, however,
allows users to adapt these privileges as required. The guilty
procedure is

DBMS_JAVA.SET_OUTPUT_TO_JAVA

. This launches
a new Java VM with the privileges of the SYS user and starts by
executing any SQL code passed to it with said privileges. Litchfield
has demonstrated how, by using appropriate parameters when calling

DBMS_JAVA.SET_OUTPUT_TO_JAVA

,
an unprivileged user is able to escalate to a fully-privileged DBA
user. Thanks to the changes previously made to the Java policy table,
he is now able to execute operating system commands. Litchfield
illustrated this under Windows 7 by creating a new user to which he
then assigned administrator privileges.

He also demonstrated that it is possible to circumvent the
database's Label Security, for which Oracle has received EAL4
certification under Common Criteria. Label Security is intended to
ensure that users are only able to see information intended for them.
He demonstrated that vulnerabilities in the Java implementation allow
arbitrary dynamic libraries to be loaded into the Oracle process. This
gives them access to data which should be strictly locked down by Label
Security.

Litchfield reports that he informed Oracle of the vulnerabilities
back in November. No patch has yet been forthcoming. As a workaround,
he recommends removing the generous execution privileges of

PUBLIC

from the

DBMS_JAVA

,

DBMS_JAVA_TEST

and

DBMS_JVM_EXP_PERMS

packages.

Although video of Litchfield's talk was available from the Black Hat DC 2010
site, The H found that the video has since been removed.