Security squabble

An alert reader recently notified us about a potentially serious security vulnerability in Oracle’s Internet Application Server, in which any default installation of a PL/SQL gateway leaves the system open to attack.

PL/SQL procedures are pieces of code stored in the database that can be executed multiple times. Many of these procedures are very powerful, providing the ability to view, create, modify and delete data and many database components, such as tables. These procedures can be accessed through a Web browser, so anyone on the Internet could execute SQL commands if they had the access in the database to run these procedures.

Matt Scheetz, a database analyst for the city of Fort Collins, Colo., argues that anyone with a browser and some SQL command knowledge easily could read the contents of an entire table, create new stored procedures, create tables and insert data into a database, using SQL commands through a Web browser.

Network World investigated Scheetz’s claims and verified that the vulnerability exists. Using a default installation of Oracle 9i on Windows 2000, we ran a series of tests against the database by accessing it through a Web server/Oracle application server front end. We first created an HTTP request calling the owa_util stored procedure, a function that provides the ability to read the data in the database. By making this request, we could read all the data stored in the database.

Next, we used the dbms_utility function to create our own stored procedure, which gives us the ability to create tables, add data to tables and delete data from tables. We could do this by entering an HTTP request containing SQL commands in a Web browser – a very simple process.

Scheetz performed some testing of his own and discovered more than 120 sites vulnerable to these attacks. He contacted several of the sites, informing them about their vulnerability and explained how to properly secure their installations.

For its part, Oracle is aware of the vulnerability and first discussed it in a security bulletin released in February 2002, which was revised July 5. The company recently announced it would fix the potential problem in the next version of Oracle 9I Application Server, due out this spring.

But Scheetz says that the security bulletins come up short because they do not explicitly tell database administrators that the vulnerability exists not in an improperly configured database, but in a database running the default settings.

The issue of security bulletins is an important one that affects customers of all the major vendors. To get some idea of the scope of the overall problem of security vulnerabilities, a total of 1,341 vulnerabilities were announced in 2002, including 488 in the last three months of the year, according to the ICAT security vulnerability metabase (icat.nist.gov).

Some industry security experts agree with Scheetz that Oracle’s bulletin should have said more than it did from the get-go. “The way I read [the bulletin] is that if I didn’t do something, then I’m OK,” says Joel Snyder, a member of Network World’s Global Test Alliance and senior partner at Opus One. But that is not the case. If you did nothing, you would be vulnerable.

Derek Cheng, senior consultant at Deloitte & Touche, adds that Oracle “should use the word ‘default’ configuration” in the bulletin, specifically stating that an “out-of-the-box” installation will leave you vulnerable.

On the other hand, Mark Edmead, president of MTE Software, a security service provider, does not take any real issue with the security bulletin. He says Oracle is assuming that it is the database administrator’s responsibility to implement security.

Devilish detailsincluded sample exploit code, but most researchers avoid including actual code because it might give hackers too much information.

Just how detailed a security bulletin should be is a subject for debate in security circles. Some bulletins, such as the Macromedia JRUN bulletin eEye Security issued in mid-November

Other vulnerability announcements go to the other extreme, including almost no useful information and making it difficult to even identify if you are vulnerable.

In the case of the Oracle vulnerability, the security bulletin (DocFinders: 4524 and 4525) discusses a vulnerability that exists if public access is granted to powerful PL/SQL procedures.

The Oracle bulletin goes on to say this vulnerability can be avoided by “customers who have granted public access to PL/SQL procedures” in two ways: by revoking public access granted to OWA, SYS and DBMS procedures or by disabling access to URLs that match criteria that would be used to exploit these procedures.

What the bulletin does not say is that these procedures are granted public access by default, so any default installation of the PL/SQL gateway (including Oracle Application Server, WebDB/Portal listener and iAS) is vulnerable.

According to Mary Ann Davidson, chief security officer at Oracle, Oracle 9i Application Server (Release 2 Version 9.0.4), scheduled to be released this spring, will block access to procedures such as OWA and SYS by default. Oracle also recently released a security checklist for Oracle Application Server which includes a discussion on protecting PL/SQL procedures.

Shared responsibility

This case points to the fact that both vendors and network administrators share responsibility for security. Vendors have a responsibility to disclose known security issues with their products and provide patches, hotfixes or configuration changes to remove the identified issue in a timely fashion. Administrators also need to keep up with the latest security bulletins and to understand the effect that vulnerabilities might have on their systems, networks and organization.

The security community has worked to develop standards and best practices to help network professionals reach these security goals.

SANS and the Center for Internet Security have created checklists and benchmarks to help administrators better understand security and how it should be implemented to gain the maximum level of effectiveness.

Andress is president of ArcSec Technologies, a security company focusing on product reviews and analysis. She can be reached at mandy@arcsec.com.