SQL Injection in package SYS.KUPV$FT

Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published Alerts
Upcoming Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap

SQL Injection in package SYS.KUPV$FT_INT

Name	SQL Injection in package SYS.KUPV$FT_INT
Systems Affected	Oracle 10g Release 1
Severity	High Risk
Category	SQL Injection
Vendor URL	http://www.oracle.com/
Author	Alexander Kornbrust (ak at red-database-security.com)
Advisory	17 Jan 2006 (V 1.00)

Details
The package SYS.KUPV$FT_INT contains 16 SQL injection vulnerabilities in the functions UPDATE_JOB, ACTIVE_JOB, ATTACH_POSSIBLE, ATTACH_TO_JOB, CREATE_NEW_JOB, DELETE_JOB, DELETE_MASTER_TABLE, DETACH_JOB, GET_JOB_INFO, GET_JOB_QUEUES, GET_SOLE_JOBNAME, MASTER_TBL_LOCK, VALID_HANDLE. Oracle is now using bind variables to fix these vulnerabilities.

Package	Function/Procedure	Vulnerability / Change
KUPV$FT_INT	UPDATE_JOB	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	ACTIVE_JOB	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	ATTACH_POSSIBLE	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	ATTACH_TO_JOB	Parameter jobid vulnerable against SQL Injection
KUPV$FT_INT	CREATE_NEW_JOB	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	DELETE_JOB	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	DELETE_MASTER_TABLE	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	DETACH_JOB	Parameter handle vulnerable against SQL Injection
KUPV$FT_INT	GET_JOB_INFO	Parameter handle, job_id vulnerable against SQL Injection
KUPV$FT_INT	GET_JOB_INFO (2nd function)	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	GET_JOB_QUEUES	Parameter handle, job_id vulnerable against SQL Injection
KUPV$FT_INT	GET_JOB_QUEUES (2nd function)	Parameter user_name, job_name vulnerable against SQL Injection
KUPV$FT_INT	GET_SOLE_JOBNAME	Parameter user_name is vulnerable against SQL Injection
KUPV$FT_INT	MASTER_TBL_LOCK	Parameter user_name, job_name, master_objid vulnerable against SQL Injection
KUPV$FT_INT	SET_EVENT	Parameter event_number, level vulnerable against SQL Injection
KUPV$FT_INT	VALID_HANDLE	Parameter handle vulnerable against SQL Injection

Patch Information
Apply the patches for Oracle CPU Jan 2006 on top of Oracle 10g Release 1.

[metalink.oracle.com]

History
01-nov-2005 Oracle secalert was informed about vulnerabilities in
ACTIVE_JOB, ATTACH_JOB, ATTACH_POSSIBLE, CREATE_NEW_JOB, DELETE_JOB, UPDATE_JOB
02-nov-2005 Oracle secalert asked for an exploit
17-jan-2006 Oracle published CPU January 2006
17-jan-2006 Advisory published