Oracle 0-day to get SYSDBA access to the database

Tanel Poder has found a way to get SYSDBA access to the Oracle database b=
y utilising a user who has the BECOME USER system privilege, execute priv=
ileges on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user w=
ith these privileges can become SYS (but not SYSDBA) and then use an imme=
diate debug event to cause a debugger to flip the SYSDBA bit in the PGA t=
o set a dedicated server session to an SYSDBA one, from there the user ca=
n do anything else. The user needs to have these privileges so its not an=
 open and shut case but serious in that a privilege escalation is still p=
ossible. Tanels post is here http://blog.tanelpoder.com/2007/11/10/oracle=
-security-all-your-dbas-are-sysdbas-and-can-have-full-os-access/ and my b=
log entry / analysis is here - http://www.petefinnigan.com/weblog/archive=
s/00001126.htm=0D
=0D
cheers=0D
=0D
Pete