DoS risk from Oracle9i debugging bug
Breakable
Posted in Security, 14th August 2002 15:13 GMT
Free whitepaper – Hands on with Hyper-V 3.0 and virtual machine movement
A flaw in the debugging mechanism of Oracle9i supplies a mechanism for crackers to crash vulnerable servers.
All Oracle9i installations are vulnerable to this attack, according to security tools firm ISS, which discovered the problem. The flaw could be used to launch denial of service attacks, it warns.
Oracle9i has a debugging facility (enabled by default) which lets database administrators collect additional information about the operation of the server.
But the Oracle9i SQL*NET listener does not correctly handle certain types of debug requests that are submitted over the network. If Oracle9i encounters such a request, it will crash and no longer field SQL requests from authorised servers or clients.
Functionality can only be restored after a manual restart, according to an alert on the problem by ISS.
Oracle has issued a patch to address the issue, which can be obtained through its
Worldwide Support Services Web site.
Admins are also advised to consider filtering SQL*NET port TCP/1521 at all border gateways to limit access to the Oracle listener and mitigate the risk of the vulnerability. ®
Free whitepaper – Hands on with Hyper-V 3.0 and virtual machine movement
Send corrections
The new Office Garage series:
Data control in the cloud
Top 10 SIEM implementer’s checklist
