Oracle Secure Backup 10g Remote Code Execution

2009, Jan 14    

**Product Description


Oracle Secure Backup is a centralized tape backup management software providing secure data protection for heterogeneous file systems and the Oracle Database.


The Oracle January 2009 Critical Patch Update fixes a vulnerability which allows a remote preauthenticated attacker to execute arbitrary code in the context of the user running the web server of Oracle Secure Backup.

In Windows environments, the vulnerability allows execution of arbitrary code as SYSTEM. In Unix and GNU/Linux environments, however, just as a normal user (oracle usually).

**CVSS2 Risk Score


Microsoft Windows: 10

Linux and Unix   :  7,5

**Affected versions


Oracle Secure Backup version to in all supported operating systems are affected.

Vulnerability Details

Oracle Secure Backup comes with one PHP based frontend which is vulnerable to a variable poisoning attack regardless if the PHP directive register_globals is enabled or not.

Internally, all the variables passed to the script login.php are converted to global variables in the file $ROOT\php\globals.php. Any variable regarding or regardless the method used to send the query will be registered as a global variable.

From the login script called “login.php” the tool “obt.exe” is executed with a popen call passing arguments received from the client. These arguments are not sanitized nor verified and it allows post-authentication remote command execution BUT due to a logic failure in the script “login.php” when the variable “clear” has the value “no” and other variables (that supposedly comes from a cookie) are set anyone can execute

operating system command from remote without being authenticated. The vulnerable code is the following:

if (strlen($ora_osb_bgcookie) > 0 && $button == “Logout”)
  1. {
  2. // Turn DEBUG_EXEC to off
  3. $tmp = $DEBUG_EXEC;
  4. $DEBUG_EXEC = "no";
  6. // Teminate the connection.
  7. $qr_command = "$rbtool –terminate $ora_osb_bgcookie-$ora_osb_lcookie";
  8. $msg = exec_qr("$qr_command");
  10. if (strncmp($msg[], "Error:", 6))
  11. {
  12. // Set the cookie up.
  13. setcookie("ora_osb_bgcookie", "");
  14. setcookie("ora_osb_lcookie", "");
  15. $ora_osb_bgcookie = "";
  16. }
  18. // Reset DEBUG_EXEC.
  19. $DEBUG_EXEC = $dtmp;
  20. }
  21. header("Location: /login.php?clear=yes");
  22. }

The function “exec_qr” internally calls the function PHP function “popen” to execute a command. The $rbtool variable, abusing from the variable poisoning attack, can be changed to, in example, /bin/sh or cmd.exe to execute arbitrary commands without the need for a user name or password, just with network access to the Oracle Secure Backup Web server. In fact, the script thinks that we’re doing a logout.

Proof of Concept

  • Create a file in the directory “c:\”


  • Create a PHP backdoor



Disable the web server.

Patch information

Oracle fixed the vulnerability in version of Oracle Secure Backup.

Contact Information

The vulnerability was found by Joxean Koret, admin[at]joxeankoret[dot]com


Oracle Secure Backup exec_qr() Command Injection Vulnerability


Oracle Critical Patch Update January 2009

Professional Web


The information in this advisory and any of its demonstrations is provided “as is”

without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of using the

information or demonstrations provided in any part of this advisory.