Oracle Database is a relational database management system (RDBMS). It provides comprehensive database applications to enterprise-level users. To extend the functionality of the Oracle Database Server, Oracle provides multiple packages of related program objects. The DBMS_AQADM_SYS package is one of them. The package provides subprograms to manage the administration of Oracle Streams Advanced Queueing (AQ).

An SQL injection vulnerability exists in DBMS_AQADM_SYS package. To be specific, a procedure GRANT_TYPE_ACCESS included in this package doesn’t sanitize its parameter correctly, the profile of the procedure is listed as bellow:

 Argument Name Type In/Out? ------------------------------ USER_NAME VARCHAR2 IN 

The parameter user_name of the procedure is later used in the following SQL sentences:

 EXECUTE_STMT( 'grant execute on sys.aq$_agent      to '|| USER_NAME||GRANT_OPT); EXECUTE_STMT('grant execute on sys.aq$_dequeue_history      to '|| USER_NAME||GRANT_OPT); 

A remote attacker could exploit this vulnerability by embedding malicious SQL code as part of the vulnerable parameter user_name. Successful exploitation would result in modification or manipulation of the user permissions in the underlying database.

SonicWALL UTM team has released an IPS signature to detect/prevent generic attacks addressing this vulnerability. The signature is listed as bellow:

• 1438 Oracle DB GRANT_TYPE_ACCESS Procedure SQL Injection

This vulnerability has been assigned the CVE identifier CVE-2009-0977.