Oracle Database Java Stored Procedure Race Condition Remote Code Execution Vulnerability

October 12th, 2010
ZDI-10-201 ZDI-CAN-667

CVE ID

CVE-2010-2419

CVSS Score

9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected Vendors

Oracle

Affected Products

Database Server

Vulnerability Details

This vulnerability allows remote attackers to break out of the Java Sandbox implemented by Oracle's relational database. Authentication is required in that a user must be able to create a Java stored procedure to trigger the issue.

The specific flaw exists within Oracle's custom SecurityManager implementation. Due to the implementation's dependence on a flag of a particular object to determine success or failure of a privileged call, a race condition exists which will allow one to execute Java code bypassing the sandbox. Successful exploitation will allow an attacker to execute arbitrary code in the context of the server.

Additional Details

Oracle has issued an update to correct this vulnerability. More details can be found at:
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

Disclosure Timeline

  • 2010-01-15 - Vulnerability reported to vendor
  • 2010-10-12 - Coordinated public release of advisory

Credit

Sami Koivu

Back to Advisories