Text 239, 57 rader
Skriven 2004-08-04 19:51:52 av Ellen K (1:379/45)
    Kommentar till text 237 av Geo. (1:379/45)
Ärende: Re: Oracle vulnerabilities
==================================
Thanks.   :)

Here's what I've been able to find out so far:

1.  vulnerability when there is an ftp server on the same box as Oracle 2. 
several flavors of buffer-overflow vulnerabilities, including: 
     A.  one that lets someone without even a valid userid grab full control of
Oracle (and if it's on a Windows server, the entire server)
     B.  one that lets someone with a valid userid but normally limited
privileges upgrade themselves to dba 3.  SQL injection vulnerabilities in
web-based apps (and I would guess normal client-server apps also, if there is
inadequate data validation in the front end) that talk to an Oracle database 4.
 Issues in PL/SQL that compromise security — this is the worst (in general, not
for us) because regardless of anything Oracle does there are zillions of PL/SQL
apps out there.

I discussed this with our Oracle consultant.  He had actually been planning to
create an ftp server on our Oracle box to facilitate file exchange with our
fulfillment houses.  I suggested that instead he create a script on the Unix
box that will go to the fulfillment houses' ftp sites and limit traffic on the
port(s) used to the IP addresses of the fulfillment houses.  He also said he
would write a script that would immediately notify him if anyone without a
valid userid tried to log onto our system.   I suggested that in addition he
put in something to limit the length of userid and length of password that the
system will even attempt to validate.





> From: "Geo." <georger@nls.net>
> I think the bugtraq letter is a for pay notice service, according to osv it's
> not been released public yet.
> http://www.osvdb.org/displayvuln.php?osvdb_id=8286
> Geo.
> "Ellen K." <72322.1016@compuserve.com> wrote in message
> news:mrt0h0t8hal9s77otdo9fa3p8do8g2ctcr@4ax.com...
>> Does anyone get the bugtraq letter that reports on Oracle stuff?   (I
>> only get the NT one.)  Apparently David Litchfield revealed a whole
>> bunch of Oracle vulnerabilities at the Black Hat thing... one of our
>> directors sent an email mentioning a WSJ article about it to my boss,
>> who asked me to follow up... blabla googling around I read that
>> yesterday's bugtraq letter carried a lot of information but I can't find
>> anything on the SecurityFocus site.
>> 
>> PLEEZE if you get or can get this, send it to me at work, if you need my
>> work email post here that you have it and I will send you my work email
>> address...  or just post the whole thing here.
>> 
>> Conflicting reports, but apparently multiple different flavors of
>> vulnerabilities from our favorite the buffer overflow to problems in
>> PL/SQL.
>> 
>> Thanks in advance.   :)

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)