tag:blogger.com,1999:blog-4357333041761721262026-05-06T11:56:04.806+01:00The rants of a Oracle Database Security Consultant. 1521 is the unofficial port of the Oracle database listener.Simon Fletcherhttp://www.blogger.com/profile/09412451086711899558noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-435733304176172126.post-86779686390659163352010-02-20T09:30:00.001+00:002010-02-20T15:59:57.972+00:00

The Oracle database initialization parameter SQL92_SECURITY is an often overlooked security parameter. Either because people don't understand it or because they think it's irrelevant.So what does it do? Well, to quote the documentation:"The SQL92 standards specify that security administrators should be able to require that users have SELECT privilege on a table when executing an UPDATE or DELETE

Simon Fletcherhttp://www.blogger.com/profile/09412451086711899558noreply@blogger.com14tag:blogger.com,1999:blog-435733304176172126.post-57424796651169619502010-02-08T13:23:00.019+00:002010-02-09T10:51:28.018+00:00

David Litchfield of NGS Software recently gave a presentation at Black Hat DC 2010 entitled "Hacking Oracle11g". In this presentation he discloses a couple of vulnerabilities that allow an unprivileged database user to execute arbitrary commands on the database host. In Linux/Unix environments this mean running commands as the Oracle owner (normally "oracle") and on Windows environments as "

Simon Fletcherhttp://www.blogger.com/profile/09412451086711899558noreply@blogger.com6tag:blogger.com,1999:blog-435733304176172126.post-34241682089302405272009-11-27T08:54:00.014+00:002010-02-09T10:45:11.215+00:00

My first rant on this blog might as well be one of my favourites, although regrettably a bit long... I frequently see on customer sites database profiles implemented for application users but not for database administrators or default accounts (e.g. SYS & SYSTEM). Okay basic refresh: Database profiles enforce resource and password restrictions on database user accounts. It’s these password

Simon Fletcherhttp://www.blogger.com/profile/09412451086711899558noreply@blogger.com2