Oracle 0-day to get SYSDBA access
Tanel Poder has found a way to get SYSDBA access to the Oracle database by
utilising a user who has the BECOME USER system privilege, execute privileges
on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user with these
privileges can become SYS (but not SYSDBA) and then use an immediate debug
event to cause a debugger to flip the SYSDBA bit in the PGA to set a dedicated
server session to an SYSDBA one, from there the user can do anything else. The
user needs to have these privileges so its not an open and shut case but
serious in that a privilege escalation is still possible. Tanels post is here
http://blog.tanelpoder.com/2007/11/10/oracle-security-all-your-dbas-are-sysdbas-and-can-have-full-os-access/
and my blog entry / analysis is here -
http://www.petefinnigan.com/weblog/archives/00001126.htm
cheers
Pete