NGSSoftware Insight Security Research Advisory

Name: Oracle 10g/9i Trigger Abuse
Systems Affected: Oracle 10g/9i on all operating systems	
Severity: High risk
Vendor URL: http://www.oracle.com/
Author: David Litchfield [ davidl at ngssoftware.com ]
Relates to: http://www.nextgenss.com/advisories/oracle-01.txt
Date of Public Advisory: 23rd December 2004
Advisory number: #NISR2122004I
Advisory URL: http://www.ngssoftware.com/advisories/oracle23122004I.txt

Description
***********
Database triggers exist to help maintain data integrity and perform certain
actions when a table's data is modified. Many of the default triggers in
Oracle can be abused to gain elevated privileges.

Details
*******

Triggers are written in PL/SQL and execute with the privileges of the
definer/owner. 


The trigger SDO_CMT_CBK_TRIG, owned by MDSYS, fires when a DELETE is
performed on the SDO_TXN_IDX_INSERTS table also owned by MDSYS. PUBLIC has
the SELECT, INSERT, UPDATE and DELETE object privileges on this table.
Consequently, anyone can cause the SDO_CMT_CBK_TRIG trigger to fire by
deleting a row from the table. If we examine the text of the trigger we can
see that, before the DELETE actually occurs, a list of functions are
selected from the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE tables and
then these functions are executed. PUBLIC has no object privileges set for
either of these tables so they can not insert their own funtion name.
However, the PRVT_CMT_CBK package owned by MDSYS has two procedures,
CCBKAPPLROWTRIG and EXEC_CBK_FN_DML, that take as their parameters a schema
and function name which are then inserted into the SDO_CMT_DBK_FN_TABLE and
SDO_CMT_CBK_DML_TABLE tables. PUBLIC has the EXECUTE permission on the
PRVT_CMT_CBK package and, as it has not been defined with the 'AUTHID
CURRENT_USER' keyword, the package executes using the rights of MDSYS, the
definer, and not the invoker. As a result of this anyone can indirectly
insert function names into the SDO_CMT_DBK_FN_TABLE and
SDO_CMT_CBK_DML_TABLE tables. Thus when a DELETE occurs on
SDO_TXN_IDX_INSERTS anyone can influence what actions the SDO_CMT_CBK_TRIG
trigger takes - in other words, anyone can get the trigger to execute an
arbitrary function. What is more, this function, as it is being executed
from the trigger will run with the privileges of MDSYS and an attacker can
exploit this to gain elevated privileges.



The MDSYS.SDO_GEOM_TRIG_INS1 is vulnerable to SQL injection on both 9i and
10g. The trigger executes the following 

..
..
EXECUTE IMMEDIATE
'SELECT user FROM dual' into tname;
stmt :=  'SELECT count(*) FROM SDO_GEOM_METADATA_TABLE ' ||
'WHERE sdo_owner = ''' || tname || '''  ' ||
'  AND sdo_table_name = ''' || :n.table_name || ''' '||
'  AND  sdo_column_name = ''' || :n.column_name || '''  ';
..
..

when an INSERT is performed on MDSYS.USER_SDO_GEOM_METADATA. The
:new.table_name and :new.column_name can be influenced by the user and SQL
injected. PUBLIC has the permissions to INSERT into this table. As such the
trigger can be abused to gain MDSYS privileges - a DBA.



The MDSYS.SDO_LRS_TRIG_INS trigger fires when an INSERT occurs on the
MDSYS.USER_SDO_LRS_METADATA view. PUBLIC can insert into this view and so
cause the trigger to fire. This trigger is vulnerable to SQL injection. Both
Oracle 9i and 10g are affected. It executes 

..
..
stmt :=  'SELECT count(*) FROM SDO_LRS_METADATA_TABLE ' ||
' WHERE sdo_owner = '''   || UPPER(user_name) || '''  ' ||
'  AND  sdo_table_name = '''  || UPPER(:n.table_name) || ''' ' ||
'  AND  sdo_column_name = ''' || UPPER(:n.column_name) || ''' ';
EXECUTE IMMEDIATE stmt INTO vcount;
..
..

and :new.table_name and :new.column_name are user supplied in the insert
statement. This is where an attacker can insert SQL.






Fix Information
***************
A patch (#68) was released for this problem by Oracle. See
http://metalink.oracle.com/ for more details. NGSSQuirreL for Oracle
(http://www.nextgenss.com/squirrelora.htm), can be used to assess whether
your Oracle servers are vulnerable to this.


About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com