Check Point Advisories

Oracle Database Server SQL Query Directory Traversal (CVE-2005-0701)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-204
Date Published:	16 Nov 2009
Severity:	High
Last Updated:	Monday 16 November, 2009
Source:
Industry Reference:	CVE-2005-0701
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Oracle UTL_FILE package is a set of PL/SQL procedures that allow a database user to manipulate files on the server. Supported operations include: read, write, rename, and remove. The files that are available to users are restricted to directories that have been specified in the utl_file_dir parameter or directories which have been created with the create directory command. There exists multiple directory traversal vulnerabilities in Oracle Database server. The vulnerabilities are caused by insufficient input validation on file name and path arguments passed to several file processing functions. These vulnerabilities allow a malicious SQL query to traverse outside of directories a user would normally have access to. A remote attacker successfully exploiting these vulnerabilities may read or modify arbitrary files on the vulnerable system. The vulnerability itself does not directly affect the behaviour of the vulnerable system. A file outside the set of permitted directories is available to the attacker to read, write, rename or remove. It may be possible to for an attacker to write malicious content to the target to be used in conjunction with other attacks. Alternatively, an attacker may read sensitive information that may be used to leverage other exploits. In attacks where malicious executable script files are copied into the StartUp directory on a Windows system, the malicious script would execute upon a subsequent reboot of the attacked machine. The behaviour of the machine after such exploitation is dependent on the intent of the malicious script. Finally, if files necessary to the proper functioning of the Oracle product or the system are renamed or removed, the target may exhibit instability or other unusual behaviour.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Oracle Database Server SQL Query Directory Traversal protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Oracle Protection Violation.
Attack Information: Oracle Database Server sql query directory traversal