Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Oracle Secure Backup NDMP CONECT_CLIENT_AUTH Command Buffer Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2009-029
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory: SA33525
Industry Reference(s): CVE-2008-5444
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
VSX
  • NGX R65
InterSpect
  • NGX
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Oracle Secure Backup 10.1.0.3
Oracle Secure Backup 10.2.0.2
Vulnerability Description
A buffer overflow vulnerability was reported in Oracle Secure Backup. Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage (NAS) devices and distributed hosts. Oracle Secure Backup is using NDMP protocol to perform backup tasks for all clients. Oracle Secure Backup fails to properly handle NDMP messages. Remote unauthenticated attackers can exploit this vulnerability by sending specially crafted messages to the affected interface. Successful exploitation can lead to arbitrary code execution.  
Update/Patch Available
Apply patches:
Oracle Critical Patch Update Advisory
Vulnerability Details
The vulnerability is due to insufficient boundary checking when handling NDMP CONNECT_CLIENT_AUTH messages. The application does not correctly verify the length of the Username field in CONNECT_CLIENT_AUTH messages.

Protection Overview
By enabling this protection, SmartDefense will detect and block attempts to exploit a buffer overflow vulnerability in Oracle Secure Backup.

In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Database Protections > Oracle > Oracle Secure Backup NDMP CONECT_CLIENT_AUTH Command Buffer Overflow.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Oracle Protection Violation
Attack Information: Oracle secure backup NDMP CONECT_CLIENT_AUTH command buffer overflow

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Database Protections > Oracle.
2. Select the following protection:

Oracle Secure Backup NDMP CONECT_CLIENT_AUTH Command Buffer Overflow

3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Oracle Protection Violation
Attack Information: Oracle secure backup NDMP CONECT_CLIENT_AUTH command buffer overflow

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Database Protections > Oracle > Oracle Secure Backup NDMP CONECT_CLIENT_AUTH Command Buffer Overflow.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Oracle Protection Violation
Attack Information: Oracle secure backup NDMP CONECT_CLIENT_AUTH command buffer overflow

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Database Protections > Oracle.
3. Select the following protection:

Oracle Secure Backup NDMP CONECT_CLIENT_AUTH Command Buffer Overflow

4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Oracle Protection Violation
Attack Information: Oracle secure backup NDMP CONECT_CLIENT_AUTH command buffer overflow

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Intelligence > NDMP, and select the NDMP Compliance protection group.
3. Click ndmp_compliance:authentication_too_large_alert (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: NDMP Compliance
Description: ndmp_compliance:authentication_too_large_alert