Vulnerability

    perl

Affected

    perl with databases

Description

    Simon Kenton  found following.   This was  tested on  Solaris  2.6
    running Netscape Enterprise Server, Perl5, and Oracle.   Inputting
    40,001  or  more  characters  into   any  form  field  causes   an
    application error.   Inputting 80,001  or more  characters  causes
    additional errors.

    Output From Web server:

        DBD::Oracle::db prepare failed: ORA-01704: string literal too long (DBD ERROR:
        OCIStmtExecute/Describe) at /usr/local/lib/perl5/site_perl/5.005/DBIx.pm line
        183.
        DBD::Oracle::db prepare failed: ORA-01704: string literal too long (DBD
        ERROR: OCIStmtExecute/Describe) at
        /usr/local/lib/perl5/site_perl/5.005/DBIx.pm line 183. DBD::Oracle::db prepare
        failed: ORA-01704: string literal too long (DBD ERROR:
        OCIStmtExecute/Describe) at /usr/local/lib/perl5/site_perl/5.005/DBIx.pm line
        183.

    When   40,001+ characters,  are entered  into a  textbox field and
    submitted  via  the  form,  the  web server displays the directory
    structure  of  the  server,  the  version  of  Perl  running,  and
    divulges the fact  that Oracle is  installed on the  system.  This
    gives  an  attacker  information  about  a system that only system
    administrators have a legitimate  need to know.   This information
    could help an attacker craft a successful attack against a  server
    with this  vulnerability.   When 80,001+  characters are submitted
    through  the  form,  the  Perl  script  dies,  and  the web server
    displays a ‘page unavailable’  error.  Either of  these conditions
    may  be  causing  a  buffer  overflow  condition  giving a further
    opportunity for an attacker to compromise the server.

    The  HTML  form  linked  to  foo.pl  does  not limit the number of
    character that it passes to the foo.pl.  The Perl script does  not
    limit the size of data it will accept by automatically  truncating
    data input through  the form before  submitting the string  to the
    DBI module,  which does  some sanity  checking of  the SQL  string
    before the  string is  sent to  oracle for  processing.   DBI is a
    module for perl that is used provide connectivity between perl and
    databases (such as Oracle).   This does prevent corruption of  the
    database  as  the  DBIx  module  seems  to  be  dying  while it is
    preparing  the  SQL  statement  before  the statement is passed to
    oracle, which causes  an error in  Perl as opposed  to potentially
    causing an error in Oracle.

    H.D.Moore  saw  a  similar  situation  with  Sybase.  The issue is
    really  that  the  perl  script  exists  when  the database module
    recieves an  unexpected error.   The database  is coming  back and
    saying the  field is  too long,  but the  perl DBD  module doesn't
    know how to  handle it, so  it just exits.   If the actual  Oracle
    server dies, then you may have a serious problem.

Solution

    As a couple of people (on and off the list) have stated it is  the
    job  of  the  perl  programmer  to handle these errors gracefully.
    In this case 'foo.pl' will be fixed so that it no longer  divulges
    this information.