O-013: Buffer Overflow in Oracle Binary

[***** Start Oracle Security Alert #59 *****]

Oracle Security Alert #59
Dated: 20 October 2003
Severity: 2

Buffer Overflow in Oracle Binary

Description
A potential security vulnerability has been discovered in the "oracle" and "oracleO" (the letter O)
binaries in the Oracle Database Server. This buffer overflow may allow a malicious local user to
run code of their choice on the server machine.

Products Affected
Oracle 9i Database Release 2, Version 9.2.x
Oracle 9i Database Release 1, Version 9.0.x
Oracle 8i Database Release 8.1.x

Platforms Affected
All supported UNIX and Linux operating system variants.

Required conditions for exploit
A valid account on the operating system hosting the Oracle Database server.

Risk to exposure
This buffer overflow may allow a malicious local user to run code of their choice as the
owner and group of these binaries, typically the "oracle" user, and the "dba" group. Oracle
is aware of an exploit for this potential vulnerability.

How to minimize risk
See Workaround, below. Follow Oracle’s best practices for database,
  http://otn.oracle.com/deploy/security/oracle9i/pdf/9ir2_checklist.pdf
  http://otn.oracle.com/deploy/security/oracle9i/pdf/9i_checklist.pdf
and investigate IT deployments of firewalls, etc.

Ramification for customer
Oracle recommends that customers review the severity rating for this Alert and
patch accordingly. See
  http://otn.oracle.com/deploy/security/pdf/oracle_severity_ratings.pdf
for a definition of severity ratings.

Workaround
The following workaround is appropriate for both Oracle 9i and 8i:
The "other" execute permissions should be removed from the binaries in question. Perform the
following steps:

   # cd $ORACLE_HOME/bin
   # chmod o-x oracle oracleO

In addition, verify that only trusted users are in the same group as the oracle and oracleO binaries.

No other changes are required. For example, do not remove setuid or setgid from the affected
binaries.

Patch Information
An interim (oneoff)
patch for this issue will soon be available for the following release:
    Oracle 9i Database Release 9.2.0.4 for Linux x86.

Fixed by
Please review Metalink, or check with Oracle Support Services periodically for patch availability if
the patch for your platform is unavailable. Oracle strongly recommends that you backup and
comprehensively test the stability of your system upon application of any patch prior to deleting any
of the original file(s) that are replaced by the patch.

Modification History
20OCT03: Initial release, version 1

[***** End Oracle Security Alert #59 *****]

    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/