Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
Hardcoded Password and Password Reset of OUTLN User

Name Hardcoded Password and Password Reset of OUTLN User [DB13]
Systems Affected 9i Rel. 1 - 10g Rel.2
Severity High Risk
Category Hardcoded Default Password & Password Reset
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
CVE
Advisory 16 April 2008 (V 1.00)


Details
During the creation of a materialized view the package DBMS_STATS_INTERNAL is called and resets the password of the user OUTLN to OUTLN and grants DBA privileges to this user.

[...]
GRANT_DBA_OUTLN:= 'grant dba to outln identified by outln';
[...]
GRANT_DBA_OUTLN:= 'grant on commit refresh to outln identified by outln';
[...]

Many people are not aware that the GRANT command ("GRANT CONNECT TO SYS IDENTIFIED BY ALEX") can be used to change passwords in Oracle instead of using the "ALTER USER" command . It's a bad idea to hardcode passwords and it took only 1 year to fix this issue.

In most Oracle default installations the account OUTLN is locked but some security guidelines (e.g. Oracle Practical Security) recommend to unlock the account OUTLN and set an invalid password (to avoid the error message "ORA-28000 account is locked"). Following this advisory and setting an invalid password was opening a default user with default password with DBA privileges in the Oracle database (OUTLN/OUTLN) if a materialized view was created.

I found this vulnerability during the search for backdoors in Oracle databases for the Oracle malware report of our vulnerability scanner Repscan. I was looking for the strings like "grant dba to" and found that dbms_stats_internal is executing these commands in an internal package. In Oracle 9i you can find this using the grep command in $ORACLE_HOME/rdbms/admin because strings literals are not encrypted in wrapped PL/SQL Code.
During this research I found also 3 Oracle procedures modifying the Oracle Audit-Table (Insert/Update/Delete rows from SYS.AUD$).

Patch Information
Apply the patches for Oracle CPU April 2008.


History
4-apr-2007 Oracle secalert was informed
15-apr-2008 Oracle published CPU April 2008 [DB13]
16-apr-2008 Advisory published


2008 by Red-Database-Security GmbH - last update 16-apr-2008