Advisory: Oracle Database GeoRaster API overflowTeam Shatter Exclusive

Posted February 20, 2013 by Alex Rothacker in Oracle, Security Advisory, Team Shatter Exclusive with 0 comments

Risk Level:
High

Affected versions:
Oracle Database 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3

Remote exploitable:
Yes

Credits:
This vulnerability was discovered and researched by Martin Rakhmanov of Application Security Inc.

Details:
GeoRaster is a feature of Oracle Spatial that lets you store, index, query, analyze, and deliver GeoRaster data. One of the GeoRaster APIs is prone to stack-based overflow.

*Download AppDetectivePRO Now for a FREE Database Security Assessment*

Impact:
An attacker that can connect to database with spatial support can execute arbitrary code in the server’s process context.

Vendor Status:
Vendor was contacted and a patch was released.

Workaround:
Do not install spatial support in the database.

Fix:
Apply January 2013 CPU.

CVE:
CVE-2012-3220

Links:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-oracle-database-georaster-api-overflow/

Timeline:
Vendor Notification – 5/3/2012
Vendor Response – 5/4/2012
Fix – 1/15/2013
Public Disclosure – 20/2/2013

*Download AppDetectivePRO Now for a FREE Database Security Assessment*

Leave a Reply

Name (required)

Mail (will not be published) (required)

Website

Please note: JavaScript is required to post comments.

Powered by