<<< Date Index >>>     <<< Thread Index >>>

Oracle 0-day to get SYSDBA access



Tanel Poder has found a way to get SYSDBA access to the Oracle database by 
utilising a user who has the BECOME USER system privilege, execute privileges 
on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user with these 
privileges can become SYS (but not SYSDBA) and then use an immediate debug 
event to cause a debugger to flip the SYSDBA bit in the PGA to set a dedicated 
server session to an SYSDBA one, from there the user can do anything else. The 
user needs to have these privileges so its not an open and shut case but 
serious in that a privilege escalation is still possible. Tanels post is here 
http://blog.tanelpoder.com/2007/11/10/oracle-security-all-your-dbas-are-sysdbas-and-can-have-full-os-access/
 and my blog entry / analysis is here - 
http://www.petefinnigan.com/weblog/archives/00001126.htm

cheers

Pete