Text 241, 78 rader
Skriven 2004-08-04 20:07:40 av Geo. (1:379/45)
    Kommentar till text 239 av Ellen K (1:379/45)
Ärende: Re: Oracle vulnerabilities
==================================
From: "Geo." <georger@nls.net>

My guess is this is just the tip of the iceberg. David likes to smack vendors
over the head with one security issue to wake them up so he can show them the
dozen others he has found (and have them listen).

Bet you see a whole bunch more Oracle exploits in the coming months (or at
least a whole lot of patches). That's what happened when he did his evaluation
of sqlserver.

Geo.

"Ellen K" <Ellen.K@harborwebs.com> wrote in message
news:708475.049e7a@harborwebs.com...
> Thanks.   :)
>
> Here's what I've been able to find out so far:
>
> 1.  vulnerability when there is an ftp server on the same box as Oracle
> 2.  several flavors of buffer-overflow vulnerabilities, including:
>      A.  one that lets someone without even a valid userid grab full control
of
> Oracle (and if it's on a Windows server, the entire server)
>      B.  one that lets someone with a valid userid but normally limited
> privileges upgrade themselves to dba
> 3.  SQL injection vulnerabilities in web-based apps (and I would guess normal
> client-server apps also, if there is inadequate data validation in the front
> end) that talk to an Oracle database
> 4.  Issues in PL/SQL that compromise security — this is the worst (in
general,
> not for us) because regardless of anything Oracle does there are zillions of
> PL/SQL apps out there.
>
> I discussed this with our Oracle consultant.  He had actually been planning
to
> create an ftp server on our Oracle box to facilitate file exchange with our
> fulfillment houses.  I suggested that instead he create a script on the Unix
> box that will go to the fulfillment houses' ftp sites and limit traffic on
the
> port(s) used to the IP addresses of the fulfillment houses.  He also said he
> would write a script that would immediately notify him if anyone without a
> valid userid tried to log onto our system.   I suggested that in addition he
> put in something to limit the length of userid and length of password that
the
> system will even attempt to validate.
>
>
>
>
>
> > From: "Geo." <georger@nls.net>
> > I think the bugtraq letter is a for pay notice service, according to osv
it's
> > not been released public yet.
> > http://www.osvdb.org/displayvuln.php?osvdb_id=8286
> > Geo.
> > "Ellen K." <72322.1016@compuserve.com> wrote in message
> > news:mrt0h0t8hal9s77otdo9fa3p8do8g2ctcr@4ax.com...
> >> Does anyone get the bugtraq letter that reports on Oracle stuff?   (I
> >> only get the NT one.)  Apparently David Litchfield revealed a whole
> >> bunch of Oracle vulnerabilities at the Black Hat thing... one of our
> >> directors sent an email mentioning a WSJ article about it to my boss,
> >> who asked me to follow up... blabla googling around I read that
> >> yesterday's bugtraq letter carried a lot of information but I can't find
> >> anything on the SecurityFocus site.
> >>
> >> PLEEZE if you get or can get this, send it to me at work, if you need my
> >> work email post here that you have it and I will send you my work email
> >> address...  or just post the whole thing here.
> >>
> >> Conflicting reports, but apparently multiple different flavors of
> >> vulnerabilities from our favorite the buffer overflow to problems in
> >> PL/SQL.
> >>
> >> Thanks in advance.   :)

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)