Check Point Advisories

Oracle Database Server ctxsys.driload Access Validation (CVE-2004-0637)

Vulnerability
Protection

Check Point Reference:	CPAI-2004-172
Date Published:	16 Nov 2009
Severity:	High
Last Updated:	Monday 16 November, 2009
Source:
Industry Reference:	CVE-2004-0637
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Stored procedures are a powerful feature of an Oracle database server. They are essentially a set of SQL statements that are stored server-side, which are called by name and optionally passed a set of parameters. Stored procedures provide improved performance, because only data specific to the passed parameters is returned to the client. There exists an access validation vulnerability with Oracle database server. There is an Oracle package, which is available to any database user, that allows the execution of SQL queries with database administration privileges. An authenticated attacker may exploit this issue to gain database administrator privileges and execute arbitrary SQL queries on the vulnerable product. An attacker with limited user privileges can execute arbitrary SQL statements using this vulnerability. He can add and delete users, tables, and data. He can also grant or revoke privileges to any arbitrary user. An attacker is capable of doing any administrative tasks that are usually only available to the database administrator. An attacker is not able to access resources outside of Oracle database server in the default installation. But, as noted in section 4.1, an attacker can execute stored procedures as well as SQL statements. It is possible to create a stored procedure that interfaces with an executable program that accesses resources including programs outside the database server. This scenario would be rare and specific to a particular deployment of Oracle as it requires custom application programming. However, if an attacker is aware that a site deployment of the product contains such a stored procedure, he can execute this procedure and gain some control of the target outside of the database server, depending on the behaviour of the stored procedure. Note that the attacker cannot create the stored procedure nor the underlying native executable using this vulnerability.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Oracle Database Server ctxsys.driload Access Validation protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Oracle Protection Violation.
Attack Information: Oracle Database Server ctxsys.driload access validation