How to remediate – Oracle Webserver PL/SQL Stored Procedure GET Request DoS

1. Introduction

The Oracle Webserver PL/SQL Stored Procedure GET Request DoS vulnerability allows a remote attacker to crash an affected web server by sending a request with an excessively long argument to the CGI script /ews-bin/fnord. This can disrupt service availability, preventing legitimate customers from accessing the website. Systems running vulnerable versions of Oracle Webserver are at risk. Impact is high on availability, medium on confidentiality and integrity.

2. Technical Explanation

This vulnerability occurs because the web server does not properly validate the length of input provided to the cgi script /ews-bin/fnord. An attacker can exploit this by sending a GET request with an extremely long argument, exceeding the server’s buffer capacity and causing it to crash. The CVE associated with this issue is CVE-1999-1068.

• Root cause: Missing input validation on the length of arguments passed to the /ews-bin/fnord CGI script.
• Exploit mechanism: An attacker sends a GET request containing an overly long string as part of the URL, specifically targeting the /ews-bin/fnord script. For example: http://example.com/cgi-bin/fnord?arg=A... (very long string)
• Scope: Oracle Webserver versions prior to those with the fix applied are affected. Specific version details were not provided in the context.

3. Detection and Assessment

Confirming vulnerability requires checking for the presence of the vulnerable CGI script and potentially testing its behaviour. A quick check involves listing directory contents.

• Quick checks: Use a command like ls -l /ews-bin/fnord to confirm the existence of the script.
• Scanning: Nessus plugin ID 1068 may detect this vulnerability, but results should be verified manually.
• Logs and evidence: Examine web server logs for errors related to CGI execution or buffer overflows when accessing /ews-bin/fnord. Look for entries containing “fnord” in the request path.

ls -l /ews-bin/fnord

4. Solution / Remediation Steps

The recommended solution is to remove the vulnerable CGI script from the web server.

4.1 Preparation

• Change window needs: This change requires a short maintenance window as it may temporarily disrupt service. Approval from the application owner is recommended.

4.2 Implementation

1. Step 1: Remove the /ews-bin/fnord script using the command rm /ews-bin/fnord.
2. Step 2: Restart the web server to apply the changes. The exact restart command depends on your operating system (e.g., systemctl restart apache2 or service httpd restart).

4.3 Config or Code Example

Before

-rw-r--r-- 1 root root 1234 Jan 01 00:00 /ews-bin/fnord

After

ls -l /ews-bin/  # fnord should not be listed.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue.

• Practice 1: Least privilege – running web server processes with minimal necessary permissions limits the impact if a vulnerability is exploited.

4.5 Automation (Optional)

#!/bin/bash
# Check if /ews-bin/fnord exists
if [ -f "/ews-bin/fnord" ]; then
  # Remove the file
  rm /ews-bin/fnord
  echo "Removed vulnerable script /ews-bin/fnord"
else
  echo "/ews-bin/fnord does not exist."
fi

5. Verification / Validation

Confirming the fix involves verifying that the CGI script is no longer present and attempting to access it results in an error.

• Post-fix check: Run ls -l /ews-bin/fnord. The expected output should indicate that the file does not exist.
• Re-test: Attempt to access the script via a web browser (e.g., http://example.com/cgi-bin/fnord?arg=test). A 404 error or similar should be returned.
• Monitoring: Monitor web server logs for any errors related to missing files or scripts. Look for 404 errors associated with /ews-bin/fnord.

ls -l /ews-bin/fnord # Should return 'No such file or directory'

6. Preventive Measures and Monitoring

Several measures can help prevent similar vulnerabilities.

• Baselines: Update your web server security baseline to include restrictions on CGI script usage and input validation requirements.
• Pipelines: Implement Static Application Security Testing (SAST) tools in your CI/CD pipeline to identify potential vulnerabilities like missing input validation during development.
• Asset and patch process: Maintain a regular patch cycle for all web server components, including updates that address security vulnerabilities.

7. Risks, Side Effects, and Roll Back

Removing the CGI script may disrupt functionality if other applications depend on it.

• Risk or side effect 2: Temporary service disruption during web server restart. Mitigation is to schedule the change during off-peak hours.
• Roll back: Restore the backed-up webserver configuration. Restart the web server.

8. References and Resources

• Vendor advisory or bulletin: No specific vendor advisory was provided in the context.
• NVD or CVE entry: CVE-1999-1068
• Product or platform documentation relevant to the fix: Oracle Webserver documentation regarding CGI script configuration and security best practices.