<<< Date Index >>>     <<< Thread Index >>>

Oracle - Hardcoded Password and Password Reset of OUTLN User [DB13]



Oracle - Hardcoded Password and Password Reset of OUTLN User [DB13]

Systems Affected   9i Rel. 1 - 10g Rel. 2
Severity           High Risk
Category           Hardcoded Default Password & Password Reset
Vendor URL             http://www.oracle.com/
Author             Alexander Kornbrust
Advisory               16 April 2008 (V 1.00)
Advisory URL           
http://www.red-database-security.com/advisory/oracle_outln_password_change.html



Details
During the creation of a materialized view the package DBMS_STATS_INTERNAL is 
called and resets the password of the user OUTLN to OUTLN and grants DBA 
privileges to this user. 

[...]
GRANT_DBA_OUTLN:= 'grant dba to outln identified by outln';
[...]
GRANT_DBA_OUTLN:= 'grant on commit refresh to outln identified by outln';
[...]

Many people are not aware that the GRANT command ("GRANT CONNECT TO SYS 
IDENTIFIED BY ALEX") can be used to change passwords in Oracle instead of using 
the "ALTER USER" command . It's a bad idea to hardcode passwords and it took 
only 1 year to fix this issue. 

In most Oracle default installations the account OUTLN is locked but some 
security guidelines (e.g. Oracle Practical Security from Syngress) recommend to 
unlock the account OUTLN and set an invalid password (to avoid the error 
message "ORA-28000 account is locked"). 
Following this advisory and setting an invalid password is opening a default 
user with default password with DBA privileges in the Oracle database 
(OUTLN/OUTLN) if a materialized view was created. 

I found this vulnerability during the search for backdoors in Oracle databases 
for the Oracle malware report of our vulnerability scanner Repscan. I was 
looking for the strings like "grant dba to" and found that dbms_stats_internal 
is executing these commands in an internal package. In Oracle 9i you can find 
these strings using the grep command in $ORACLE_HOME/rdbms/admin because 
strings literals are not encrypted in wrapped PL/SQL 9i Code. 

BTW: During this research I found also 3 Oracle procedures modifying the Oracle 
Audit-Table (Insert/Update/Delete rows from SYS.AUD$). I think procedures 
modifying the Audit-Log (especially delete and update) are a bad coding 
practice.


Patch Information
Apply the patches for Oracle CPU April 2008.


History
4-apr-2007 Oracle secalert was informed
15-apr-2008 Oracle published CPU April 2008 [DB13]
16-apr-2008 Advisory published