Re: AGENT WILL NOT START!

Hello all,

I don't know how to make it work either but I received the folowing message and I think it would be of your interest (specialy if someone here uses Unix Machines whith Oracle).
Folks,

This is a big heads up for everyone. If you're running Oracle 8.0.5 on a Unix box, do *not* install and configure the Intellegent Agent option. If you have, find the bin/oratclsh file and REMOVE THE SUID BIT!

oratclsh is a Tcl app that provides full access to Tcl. It's also installed as suid root. Running oratclsh gives anyone with even the most modest Tcl knowledge the ability to execute arbitrary Tcl commands *while running as root*! This includes the exec command, which spawns off a subshell (as root) to run any command on the system. Anyone with half a brain is exactly three commands away from full root access. Anyone with a whole brain is exactly *one* command away from full root access.

This hole has been verified on both Linux and Solaris with Oracle 8.0.5. It probably exists in all Unix versions of 8.0.5. Whether it exists in later versions is unknown. (I don't believe it exists in 8.0.4, but I can't verify that at the moment) I also don't know if it affects non-Unix versions of 8.0.5.

Once again, Intellegent Agent only needs to be *installed* (and the root.sh part of the setup run) to open this hole. The agent does *not* need to be started--just installed.

Dan

---------------------------------------------"it's like this"--------------
Dan Sugalski   (541) 737-3346                even samurai
SysAdmin                                     have teddy bears
Oregon University System                     and even the teddy bears
sugalskd_at_ous.edu                             get drunk

---
You are currently subscribed to oracle as: atvars_at_bestway.com.br To unsubscribe send a blank email to leave-oracle-32421C_at_telelists.com or visit the Oracle mailing list on the Web at: http://telelists.com/htbin/lyris.pl?enter=oracle&text_

mode=0

Aaron Seaton escreveu na mensagem <372EF0F9.4F598F57_at_scotiamarkets.com>...
>Hello all,
>
> I have a fresh installation of Oracle Workgroup Server 7.3 on NT and
>everything is working great, except for the Oracle Intelligent Agent
>service that is needed to run Enterprise Manager properly. When the
>service attempts to start I receive a nasty "memory exeception" error,
>and NT complains that a certian address in memory is incorrectly being
>referenced. Does anyone know how to solve this? Any help would be
>greatly appreciated.
>
> Aaron Seaton
>
Received on Thu May 06 1999 - 01:26:07 CDT