Signature Detail

HTTP: Oracle 10g Character Conversion Vulnerability

This signature detects attempts to evade pl/sql exclusions and run sensitive functions on an Oracle database server using the HTTP front-end. Attackers can run sensitive database commands and access, inject, or delete data as SYSTEM. Note: This vulnerability is referenced in Oracle Alert 68.

Extended Description

Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities. The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others. There have also been reports that issues covered in this BID and resolved in the referenced Oracle patch include trigger-abuse issues, character-set-conversion bugs, and denial-of-service vulnerabilities. More information is pending. Note that a number of unsupported versions of affected products may also potentially be vulnerable.

Affected Products

• Oracle applications 10.7.0
• Oracle applications 11.0.0
• Oracle application_server_10g 9.0.4
• Oracle application_server_10g 9.0.4 .1
• Oracle application_server_web_cache_10g 9.0.4 .0
• Oracle collaboration_suite_release_1
• Oracle configurator 11.0.0 I
• Oracle e-business_suite 10.7.0
• Oracle e-business_suite 11.0.0
• Oracle e-business_suite_11i 11.1.0
• Oracle e-business_suite_11i 11.2.0
• Oracle e-business_suite_11i 11.3.0
• Oracle e-business_suite_11i 11.4.0
• Oracle e-business_suite_11i 11.5.0
• Oracle e-business_suite_11i 11.5.1
• Oracle e-business_suite_11i 11.5.2
• Oracle e-business_suite_11i 11.5.3
• Oracle e-business_suite_11i 11.5.4
• Oracle e-business_suite_11i 11.5.5
• Oracle e-business_suite_11i 11.5.6
• Oracle e-business_suite_11i 11.5.7
• Oracle e-business_suite_11i 11.5.8
• Oracle e-business_suite_11i 11.5.9
• Oracle e-business_suite_11i 11.6.0
• Oracle e-business_suite_11i 11.7.0
• Oracle e-business_suite_11i 11.8.0
• Oracle enterprise_manager 9.0.0 I
• Oracle enterprise_manager 9.0.1
• Oracle enterprise_manager_database_control_10g 10.1.0 .0.2
• Oracle enterprise_manager_grid_control_10g 10.1.0 .0.2
• Oracle files 9.0.3 .1.0
• Oracle files 9.0.3 .2.0
• Oracle files 9.0.3 .3.0
• Oracle files 9.0.3 .3.6
• Oracle istore_11i 11I.IBE.O
• Oracle label_security 8.1.7
• Oracle label_security 9.0.1
• Oracle listener 8.0.6
• Oracle listener 8.1.6
• Oracle oracle10g_application_server 10.1.0 .0.2
• Oracle oracle10g_application_server 9.0.4 .0
• Oracle oracle10g_enterprise_edition 10.1.0 .0.2
• Oracle oracle10g_enterprise_edition 9.0.4 .0
• Oracle oracle10g_personal_edition 10.1.0 .0.2
• Oracle oracle10g_personal_edition 9.0.4 .0
• Oracle oracle10g_standard_edition 10.1.0 .0.2
• Oracle oracle10g_standard_edition 9.0.4 .0
• Oracle oracle8 8.0.1
• Oracle oracle8 8.0.2
• Oracle oracle8 8.0.3
• Oracle oracle8 8.0.4
• Oracle oracle8 8.0.5
• Oracle oracle8 8.0.5 .1
• Oracle oracle8 8.0.6
• Oracle oracle8 8.1.5
• Oracle oracle8 8.1.6
• Oracle oracle8 8.1.7
• Oracle oracle8i_enterprise_edition 8.0.5 .0.0
• Oracle oracle8i_enterprise_edition 8.0.6 .0.0
• Oracle oracle8i_enterprise_edition 8.0.6 .0.1
• Oracle oracle8i_enterprise_edition 8.1.5 .0.0
• Oracle oracle8i_enterprise_edition 8.1.5 .0.2
• Oracle oracle8i_enterprise_edition 8.1.5 .1.0
• Oracle oracle8i_enterprise_edition 8.1.6 .0.0
• Oracle oracle8i_enterprise_edition 8.1.6 .1.0
• Oracle oracle8i_enterprise_edition 8.1.7 .0.0
• Oracle oracle8i_enterprise_edition 8.1.7 .1.0
• Oracle oracle8i_enterprise_edition 8.1.7.4.0
• Oracle oracle8i_standard_edition 8.0.6
• Oracle oracle8i_standard_edition 8.0.6 .3
• Oracle oracle8i_standard_edition 8.1.5
• Oracle oracle8i_standard_edition 8.1.6
• Oracle oracle8i_standard_edition 8.1.7
• Oracle oracle8i_standard_edition 8.1.7 .0.0
• Oracle oracle8i_standard_edition 8.1.7 .1
• Oracle oracle8i_standard_edition 8.1.7 .4
• Oracle oracle9i_application_server 9.0.2
• Oracle oracle9i_application_server 9.0.2 .0.0
• Oracle oracle9i_application_server 9.0.2 .0.1
• Oracle oracle9i_application_server 9.0.2 .1
• Oracle oracle9i_application_server 9.0.2 .2
• Oracle oracle9i_application_server 9.0.2 .3
• Oracle oracle9i_application_server 9.0.3
• Oracle oracle9i_application_server 9.0.3 .1
• Oracle oracle9i_application_server
• Oracle oracle9i_application_server_portal 9.0.2 .3
• Oracle oracle9i_application_server_portal 9.0.2 .3A
• Oracle oracle9i_application_server_portal 9.0.2 .3B
• Oracle oracle_9i_application_server_release_1 1.0.2 .2
• Oracle oracle9i_application_server_reports 9.0.2
• Oracle oracle9i_application_server_reports 9.0.2 .1
• Oracle oracle9i_application_server_web_cache 9.0.2 .2
• Oracle oracle9i_application_server_web_cache 9.0.2 .3
• Oracle oracle9i_application_server_web_cache 9.0.3 .1
• Oracle oracle9i_client_edition 9.2.0 .0.1
• Oracle oracle9i_client_edition 9.2.0 .0.2
• Oracle oracle9i_enterprise_edition 8.1.7
• Oracle oracle9i_enterprise_edition 9.0.0 .2.4
• Oracle oracle9i_enterprise_edition 9.0.1
• Oracle oracle9i_enterprise_edition 9.0.1 .4
• Oracle oracle9i_enterprise_edition 9.0.1 .5
• Oracle oracle9i_enterprise_edition 9.2.0 .0
• Oracle oracle9i_enterprise_edition 9.2.0 .0.1
• Oracle oracle9i_enterprise_edition 9.2.0 .0.3
• Oracle oracle9i_enterprise_edition 9.2.0 .0.5
• Oracle oracle9i_enterprise_edition 9.2.0.2
• Oracle oracle9i_lite 5.0.0 .0.0.0
• Oracle oracle9i_lite 5.0.0 .1.0.0
• Oracle oracle9i_lite 5.0.0 .2.0.0
• Oracle oracle9i_lite 5.0.0 .2.9.0
• Oracle oracle9i_personal_edition 8.1.7
• Oracle oracle9i_personal_edition 9.0.0 .2.4
• Oracle oracle9i_personal_edition 9.0.1
• Oracle oracle9i_personal_edition 9.0.1 .4
• Oracle oracle9i_personal_edition 9.0.1 .5
• Oracle oracle9i_personal_edition 9.2.0
• Oracle oracle9i_personal_edition 9.2.0 .0.1
• Oracle oracle9i_personal_edition 9.2.0 .0.2
• Oracle oracle9i_personal_edition 9.2.0 .0.3
• Oracle oracle9i_personal_edition 9.2.0 .0.5
• Oracle oracle9i_standard_edition 8.1.7
• Oracle oracle9i_standard_edition 9.0.0
• Oracle oracle9i_standard_edition 9.0.0 .2.4
• Oracle oracle9i_standard_edition 9.0.1
• Oracle oracle9i_standard_edition 9.0.1 .2
• Oracle oracle9i_standard_edition 9.0.1 .3
• Oracle oracle9i_standard_edition 9.0.1 .4
• Oracle oracle9i_standard_edition 9.0.1 .5
• Oracle oracle9i_standard_edition 9.0.2
• Oracle oracle9i_standard_edition 9.2.0
• Oracle oracle9i_standard_edition 9.2.0 .0.1
• Oracle oracle9i_standard_edition 9.2.0 .0.2
• Oracle oracle9i_standard_edition 9.2.0 .0.3
• Oracle oracle9i_standard_edition 9.2.0 .0.5
• Oracle oracle9i_standard_edition 9.2.0 .3
• Oracle oracle_http_server 8.1.7
• Oracle oracle_http_server 9.0.1
• Oracle oracle_http_server 9.2.0 .0
• Sun sunmc 3.5.0 Update 1A
• Sun sunmc 3.5 Update 1

References

• BugTraq: 10871
• CVE: CVE-2004-1362
• URL: http://www.ngssoftware.com/advisories/oracle23122004G.txt
• URL: http://www.kb.cert.org/vuls/id/316206
• URL: http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf