{"vuid":"VU#500203","idnumber":"500203","name":"Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via help page request","keywords":["Oracle 9iAS","Oracle 9i Application Server","PL/SQL","buffer overflow","long URL request","help page","Procedural Language/ Structured Query Language","Apache"],"overview":"A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language (PL/SQL) module used by Oracle9i Application Server (iAS). This vulnerability could allow an unauthenticated remote attacker to cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process.","clean_desc":"NGSSoftware has released Insight Security Research Advisory #NISR20122001 describing two vulnerabilities in the Apache PL/SQL module used by Oracle9i Application Server (iAS). The first of these vulnerabilities, a buffer overflow, is discussed in this document. Oracle iAS uses the Apache HTTP Server to provide web services, including access to stored procedures via the Oracle PL/SQL module (modpplsql or mod_plsql). In iAS, PL/SQL is used to communicate with the database and generate HTML that can be interpreted by a web browser. The PL/SQL module also provides the ability to remotely administer the Database Access Descriptors (DAD) and access help pages. While access to the DADs is restricted by username and password, access to the help pages is not and they can be accessed by any user. A crafted HTTP request for a help page could overflow a memory buffer and overwrite the saved return address, thus crashing the Apache process or executing code of the attacker's choice. The vulnerable PL/SQL module may also be used by Oracle9i Database and Oracle8i Database.","impact":"An unauthenticated remote attacker could cause a denial of service or execute arbitrary code on the system with the privileges of the Apache process. Since the Apache service typically runs with SYSTEM privileges on Windows NT and Windows 2000, an attacker may be able to gain complete control of the system.","resolution":"Apply Patch\nApply the appropriate patch referenced in Oracle Security Alert #25.","workarounds":"Disable Vulnerable Service Disable the PL/SQL service (modplsql or mod_plsql in Apache).","sysaffected":"","thanks":"The CERT/CC thanks \nNGSSoftware\n and \nOracle\n for information used in this document.","author":"This document was written by Art Manion.","public":["http://www.nextgenss.com/advisories/plsql.txt","http://otn.oracle.com/deploy/security/pdf/modplsql.pdf","http://metalink.oracle.com/","http://otn.oracle.com/tech/pl_sql/content.html","http://www.securityfocus.com/bid/3726","http://xforce.iss.net/static/7727.php"],"cveids":["CVE-2001-1216"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2001-12-20T20:57:07Z","publicdate":"2001-12-13T00:00:00Z","datefirstpublished":"2002-01-03T17:10:06Z","dateupdated":"2002-03-15T20:24:13Z","revision":34,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"3","cam_population":"7","cam_impact":"17","cam_easeofexploitation":"7","cam_attackeraccessrequired":"20","cam_scorecurrent":"7.184625","cam_scorecurrentwidelyknown":"7.184625","cam_scorecurrentwidelyknownexploited":"13.432125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":7.184625,"vulnote":null}