Update Protection against Multiple Oracle Secure Backup Administration Server Command Injection Vulnerabilities

Vulnerability
Protection

Check Point Reference:	CPAI-2009-031
Date Published:
Severity:
Last Updated:
Source:	Secunia Advisory: SA33525
Industry Reference(s):	CVE-2008-5448 CVE-2008-4006 CVE-2008-5449
Protection Provided by:	VPN-1 NGX R65 NGX R62 NGX R61 NGX R60 VSX NGX R65 InterSpect NGX IPS-1 IPS-1 IPS-1 NGX R65
Who is Vulnerable? Oracle Secure Backup 10.1.0.3 Oracle Secure Backup 10.2.0.2
Vulnerability Description Several command injection vulnerabilities were reported in Oracle Secure Backup Administration Server. The Server allows for single point of management of data present on network attached storage (NAS) devices and distributed hosts which may have different operating systems. Remote unauthenticated attackers can exploit these vulnerabilities by sending a crafted HTTP request to the target host. Successful exploitation could allow for arbitrary command execution in the security context of the user running a vulnerable installation of Oracle Secure Backup.

Update/Patch Available
Apply patches:
Oracle Critical Patch Update Advisory

Vulnerability Details
Oracle Secure Backup Server provides a web-based console for various administrative tasks. The server side script which handles the login for providing access to the console is called login.php. The vulnerabilities are due to lack of sanitation of user supplied parameters when processing HTTP requests sent to PHP program login.php. Remote unauthenticated attackers can exploit this vulnerability by sending a crafted HTTP request to the target host.

Protection Overview
By enabling this protection, SmartDefense will detect and block attempts to exploit the command injection vulnerabilities in Oracle Secure Backup.

In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Database Protections > Oracle > Oracle Secure Backup Multiple Command Injections.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Oracle Protection Violation
Attack Information: Oracle secure backup multiple command injections

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Database Protections > Oracle.
2. Select the following protection:

Oracle Secure Backup Multiple Command Injections

3. Install security policy on all modules.

VPN-1 VSX NGX R65

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Database Protections > Oracle.
3. Select the following protection:

Oracle Secure Backup Multiple Command Injections

4. Install policy on all modules.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW2, and select the CGI Attacks protection group.
3. Click Oracle Secure Backup Administration Server login.php Command Injection (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: WWW/CGI Attacks Protection Group
Description: Oracle Secure Backup Administration Server login.php Command Injection

Legal Notice for Threat Center Advisories