Oracle Security: Insert / Update / Delete Data via Views

Insert / Update / Delete Data via Views
#######################################

This advisory <http://www.red-database-security.com/advisory/oracle_view_vulnerability.html>

Name Insert / Update / Delete Data via Views [DB17] Systems Oracle 8i - 10g Rel. 2
Severity High Risk
Category Bypass Access Control
Author Alexander Kornbrust (ak at red-database-security.com) Advisory 17 July 2007 (V 1.00)

Details
########

Updates, deletes and inserts are possible via specially crafted views without having the right privileges.

This vulnerability is not identical with similar vulnerabilities fixed with April 2006 CPU and October 2006 CPU.

Samples
#######

delete from (specially crafted view)
insert into (specially crafted view)
update (specially crafted view)

Testcases will be released if we can verify that the problem is really fixed.

Patch Information
#################

Apply the patches for Oracle CPU July 2007.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

History
#######

24-oct-2006 Oracle secalert was informed
25-oct-2006 Bug confirmed
18-jul-2007 Oracle published CPU July 2007 [DB17]
18-jul-2007 Advisory published

Analysis and CVE entries of the Oracle CPU
###########################################
<http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html>

(c) 2007 by Red-Database-Security GmbH - last update 17-jul-2007 Received on Wed Jul 18 12:30:18 2007