CVE-2001-0832

Vulnerability

Oracle 8.0.x through 9.0.1 on Unix contains a vulnerability that allows local users to overwrite arbitrary files. The issue resides in the ORACLE_HOME/rdbms/log directory or an alternate directory specified by the ORACLE_HOME environment variable. The vulnerable code path is reachable due to incorrect file permissions or a symlink attack, as described in [1].

Exploitation

An attacker must have local access to the system. By manipulating the ORACLE_HOME environment variable or creating symlinks in the rdbms/log directory, a user can cause Oracle to overwrite files writable by the Oracle process. The SETUID bit on the oracle executable facilitates this. No authentication beyond local user access is required [1].

Impact

Successful exploitation allows a local user to overwrite arbitrary files on the system, potentially leading to denial of service, privilege escalation, or data corruption. The attacker gains the ability to write to files with the privileges of the Oracle process (often oracle user) [1].

Mitigation

Limit access to the ORACLE_HOME directory to database administrators only by changing permissions to 770. If ordinary users must run SQL*Plus, they should do so using client-server model, not directly on the server. Oracle released a patch for 8.1.7; for 9.0.1, patchset 2 addressed it. Removing the SETUID bit may cause functional issues [1].