__________________________________________________________

                       The U.S. Department of Energy
                     Computer Incident Advisory Center
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

                     Oracle9i User Privileges Vulnerability
                          [Oracle Security Alert #33]

April 23, 2002 22:00 GMT                                          Number M-071
______________________________________________________________________________
PROBLEM:       A potential security vulnerability has been discovered in 
               Oracle9i database server. It is possible to create a user 
               defined in the Oracle9i database server with limited privileges 
               who can potentially access privileged data using SQL syntax for 
               outer joins. 
PLATFORM:      All platforms using Oracle9i Database, Release 9.0.1.x. 
DAMAGE:        A knowledgeable and malicious user may gain unauthorized access 
               to data in Oracle9i database server. 
SOLUTION:      Apply the patch supplied by vendor. 
______________________________________________________________________________
VULNERABILITY  The risk is LOW. A user account defined in the Oracle9i 
ASSESSMENT:    database is required to exploit this vulnerability. 
______________________________________________________________________________
LINKS: 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/m-071.shtml 
 ORIGINAL BULLETIN:                                                           
                     http://otn.oracle.com/deploy/security/pdf/sql_joins_alert.pdf 
______________________________________________________________________________

[***** Start Oracle Security Alert #33 *****]

Oracle Security Alert #33
Dated: 17 April 2002

User Privileges Vulnerability in Oracle9i Database Server

Description
A potential security vulnerability has been discovered in Oracle9i database 
server. It is possible to create a user defined in the Oracle9i database 
server with limited privileges who can potentially access privileged data 
using SQL syntax for outer joins. As such, a knowledgeable and malicious
user can gain unauthorized access to data in Oracle9i database server.

None of the Oracle8i (Release 8.1.x), Oracle8 (Release 8.0.x) or Oracle7 
database server release is affected by this vulnerability.

Products affected
Oracle9i Database, Release 9.0.1.x, only

Platforms affected
All

Workarounds
There are no workarounds to protect against this potential vulnerability.

Patch Information
Oracle has fixed the potential vulnerability identified above in the 
upcoming Oracle Database server release, Oracle9i, Release 2. Patches 
with the base bug fix number, 2121935, are being made available only for 
supported releases of Oracle9i, Releases 9.0.1.x, database server on all
supported platforms.

Download currently available patches for your platform from Oracle’ s 
Worldwide Support web site, Metalink, http://metalink.oracle.com. Activate 
the "Patches" button to get to the patches Web page. Enter the base bug fix 
number indicated above and activate the "Submit" button.

Please check with Metalink or Oracle Worldwide Support Services periodically 
for patch availability if the patch for your platform is not yet available.

IMPORTANT NOTE: If any view in the Oracle9i database server was created 
before application of your patch, re-compile all views including string 
'JOIN' (as user SYS) immediately after application of your patch.

Oracle strongly recommends that you comprehensively test the stability of 
your system upon application of any patch prior to deleting any of the 
original file(s) that are replaced by the patch.

[***** End Oracle Security Alert #33 *****]

_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Oracle Corporation for the 
information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Center, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

CIACTech02-002: Microsoft Browser Helper Objects (BHO) Could Hide Malicious Code
M-064: Cisco web interface vulnerabilities in ACS for Windows
M-065: Red Hat Race Conditions in "logwatch"
M-066: Microsoft Cumulative Patch for Internet Information Services (IIS) Vulnerabilities
M-067: SGI Mail, mailx, sort, timed, and gzip Vulnerabilities
M-068: Microsoft IE and Office for Macintosh Vulnerabilities
M-069: Microsoft SQL Server Unchecked Buffer Vulnerabilities
CIACTech02-003: Protecting Office for Mac X Antipiracy Server Ports
M-070: Apache HTTP Server on Win32 Vulnerability