mailing list archives
Re: question about oracle advisory
From: Jeff Smith <jsmith () purdue edu>
Date: 05 Aug 2003 16:45:49 -0500
I can confirm that this is Oracle's stance. I opened a TAR (technical
assistance request) to ask that they make the patch available for 8i,
which is supposed to receive error correction support until December 31,
2003. Their reply, in summary, is:
1) Bug 2716764 was introduced in 9.2 and does not apply to 8i
2) 126.96.36.199 requires patch 2988114 and 188.8.131.52.0 requires patch 2988086,
both of which address extproc buffer overflows, but apparently ones
specific to 9i versions.
3) The third bug, 2642203 (extproc buffer overflow possible on long
library name), does apply and already has a backport request in
progress. According to the Oracle tech support person, you must have a
database account and the create library privilege to exploit the bug,
which is contrary to Mr. Litchfield's follow-up letter.
This confusing situation doesn't exactly reassure me! A "repeat by"
that showed whether you were vulnerable would be helpful to many Oracle
IT Security & Policy
On Tue, 2003-08-05 at 13:40, McCartney, Daymon (US - Deerfield) wrote:
Do you have any plans to release proof of concept code for the Oracle
exploit? The reason I ask is that "due to architectural constraints,"
Oracle is not planning on releasing a patch for 8i releases. We contacted
them about this, but they're sticking to their guns about the exploit
requiring oracle authentication, and thus being a low(er)-risk
To quote the analyst that responded, "I'm not able to comment on David
Litchfield's claims, but with SECURITY ALERT 57, you need the CREATE LIBRARY
or the CREATE ANY LIBRARY privilege. The exploit is dependent on these
privileges, so if they are not granted to users, the exploit fails. How a
user could exploit these without being able to connect is difficult to even
I'd like to see them put out a patch for this, but without some more proof
of the anonymous exploit, and motivation to fix the problem regardless of
"architectural constraints", I don't think they will.