Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Oracle :: n-128.txt

Oracle Buffer Overflow in E_Business Suite (CIAC N-128)




             __________________________________________________________

                       The U.S. Department of Energy
                   Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

                   Oracle Buffer Overflow in E-Business Suite
                           [Oracle Security Alert 56]

July 25, 2003 21:00 GMT                                           Number N-128
______________________________________________________________________________
PROBLEM:       The FNDWRR CGI program is vulnerable to malformed requests that 
               may permit a knowledgeable and malicious user to cause the 
               FNDWRR executable to crash. 
SOFTWARE:      Oracle E-Busines Suite 11i, Release 1 through Release 8  
               Oracle Applications, All Releases 
DAMAGE:        May grant a user unauthorized access to Oracle E-Business 
               Suite. 
SOLUTION:      Apply patch as stated in Oracle's security alert. 
______________________________________________________________________________
VULNERABILITY  The risk is MEDIUM. A user must have HTTP access, as well as 
ASSESSMENT:    specialized knowledge to exploit this vulnerability over the 
               Internet to gain unauthorized access to Oracle E-Business 
               Suite. 
______________________________________________________________________________
LINKS: 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/n-128.shtml 
 ORIGINAL BULLETIN:  http://otn.oracle.com/deploy/security/pdf/2003alert56.pdf 
______________________________________________________________________________

[***** Start Oracle Security Alert 56 *****]

Oracle Security Alert 56
Dated: July 23, 2003
Severity: 1 

Buffer Overflow Vulnerability in Oracle E-Business Suite 

Description
A potential security vulnerability has been discovered in Oracle E-Business Suite.
The FNDWRR CGI program is vulnerable to malformed requests that may permit a
knowledgeable and malicious user to cause the FNDWRR executable to crash.
However, this crash will neither result in a Denial of Service (DoS) against Oracle 
E-Business Suite, nor prevent the FNDWRR executable from reliably serving correctly
formed requests, but it may grant a user unauthorized access to Oracle E-Business
Suite. 

Products Affected

	• Oracle E-Business Suite 11i, Release 1 through Release 8
	• Oracle Applications, All Releases 

Platforms Affected
All platforms. 

Required conditions for exploit
User with HTTP access to a Web Server set up to spawn the FNDWRR CGI program. 

	Risk to exposure 

	Risk to exposure is high, as any user with HTTP access and specialized
	knowledge can exploit this vulnerability over the Internet to gain
	unauthorized access to Oracle E-Business Suite if the conditions mentioned
	above are met. 

	How to minimize risk 

	There are no workarounds that can directly address this potential
	security vulnerability, but a patch is available (see below). Oracle
	strongly recommends that customers follow best practices for Oracle
	E-Business Suite, Metalink note 189367.1 “Best Practices for Keeping
	Your E-Business Suite Secure” available at http://metalink.oracle.com. 

	Ramification for customer 

	Customers are vulnerable unless the patch is applied. 

	Oracle strongly recommends that customers review the severity rating
	for this Alert and patch accordingly. See
	http://otn.oracle.com/deploy/security/pdf/oracle_severity_ratings.pdf
	for a definition of severity ratings. 

Patch Information
The patch enhances the robustness of the FNDWRR CGI program.

Fixed by 

Obtain and install the correct Mandatory Applications Security Patch
for your release of E-Business Suite: 

	• Oracle E-Business Suite 11i, Releases 1 through 8
	• Oracle Applications, All Releases 

Download this one-off patch from the Oracle Support Services web site, Metalink
(http://metalink.oracle.com). 

1. Click on the Patches button.
2. Click on the "New Metalink Patch Search ".
   If you are not on the "Simple Search" screen, click on the "Simple Search" 
   button.
3. Input the bug number 2919943 on the "Search by Patch Number" box.
4. Click Go.
5. Select the patch for the appropriate product version.
6. Select the appropriate platform.
7. Click Download. 

Please review Metalink, or check with Oracle Support Services periodically for 
patch availability if the patch for your platform is unavailable. 

Oracle strongly recommends that you backup and comprehensively test the stability
of your system upon application of any patch prior to deleting any of the original
file(s) that are replaced by the patch. 

Patch Availability Matrix 

Platforms			Oracle E-Business		Oracle Applications, 
				    Suite 11i			    All Releases
				   Releases 1-8
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Sun Solaris Intel (32-bit) 		N/A 				2919943 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Sun Solaris SPARC (32-bit) 		2919943 			2919943 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
IBM AIX 4.3.3 and 5L (32-bit) 		2919943 			2919943 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
MS Windows NT/2000/XP 			2919943 			2919943 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
HP-UX (32-bit) 				2919943 			2919943 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
HP Tru64 				2919943 			2919943 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
LINUX 					2919943 			N/A 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
SGI 32-bit UNIX 			N/A 				2919943
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

	N/A: The Oracle E-Business Suite Release/Version is not available for
	this platform. 

	Planned: The patch is not released yet. Future release (e.g. 11.5.9
	and higher) of the Oracle E-Business Suite will contain the fix by
	default. 

Credits
Oracle Corporation thanks Stephen Kost of Integrigy Corporation for discovering 
and promptly bringing this potential security vulnerability to Oracle’s attention. 
The Integrigy alert is available at http://www.integrigy.com/alerts.htm. 

Modification History
23-JUL-03: Initial release, version 1 

[***** End Oracle Security Alert 56 *****]

_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Oracle Corporation for the 
information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

N-118: Cisco IOS Interface Blocked by IPv4 Packet
N-119: Microsoft Internet Security and Acceleration  (ISA) Server Error Pages Could Allow Cross-Site Scripting Attack
N-120: Unchecked Buffer in Microsoft Windows Shell Could Enable System Compromise
N-121: Red Hat Updated Mozilla Packages Fix Security Vulnerability
N-122: Red Hat Updated 2.4 Kernel Fixes Vulnerabilities
N-123: SGI Login Vulnerabilities
N-124: Sun Solaris 8 LDAP Clients May Log the Proxy Agent User's Password as Clear Text
N-125: Cumulative Patch for Microsoft SQL Server
N-126: Microsoft Unchecked Buffer in DirectX Could Enable System Compromise
N-127: Buffer Overflows in EXTPROC of Oracle Database Server



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH