Text 243, 77 rader
Skriven 2004-08-04 22:01:48 av Ellen K (1:379/45)
    Kommentar till text 241 av Geo. (1:379/45)
Ärende: Re: Oracle vulnerabilities
==================================
He's been smacking Oracle over the head since they started advertising how
Oracle is "unbreakable".  :)

> From: "Geo." <georger@nls.net>
> My guess is this is just the tip of the iceberg. David likes to smack vendors
> over the head with one security issue to wake them up so he can show them the
> dozen others he has found (and have them listen).
> Bet you see a whole bunch more Oracle exploits in the coming months (or at
>least a whole lot of patches). That's what happened when he did his evaluation
> of sqlserver.
> Geo.
> "Ellen K" <Ellen.K@harborwebs.com> wrote in message
> news:708475.049e7a@harborwebs.com...
>> Thanks.   :)
>> 
>> Here's what I've been able to find out so far:
>> 
>> 1.  vulnerability when there is an ftp server on the same box as Oracle
>> 2.  several flavors of buffer-overflow vulnerabilities, including:
>> A.  one that lets someone without even a valid userid grab full control
> of
>> Oracle (and if it's on a Windows server, the entire server)
>> B.  one that lets someone with a valid userid but normally limited
>> privileges upgrade themselves to dba
>>3.  SQL injection vulnerabilities in web-based apps (and I would guess normal
>> client-server apps also, if there is inadequate data validation in the front
>> end) that talk to an Oracle database
>> 4.  Issues in PL/SQL that compromise security — this is the worst (in
> general,
>> not for us) because regardless of anything Oracle does there are zillions of
>> PL/SQL apps out there.
>> 
>> I discussed this with our Oracle consultant.  He had actually been planning
> to
>> create an ftp server on our Oracle box to facilitate file exchange with our
>> fulfillment houses.  I suggested that instead he create a script on the Unix
>> box that will go to the fulfillment houses' ftp sites and limit traffic on
> the
>> port(s) used to the IP addresses of the fulfillment houses.  He also said he
>> would write a script that would immediately notify him if anyone without a
>> valid userid tried to log onto our system.   I suggested that in addition he
>> put in something to limit the length of userid and length of password that
> the
>> system will even attempt to validate.
>> 
>> 
>> 
>> 
>> 
>> > From: "Geo." <georger@nls.net>
>> > I think the bugtraq letter is a for pay notice service, according to osv
> it's
>> > not been released public yet.
>> > http://www.osvdb.org/displayvuln.php?osvdb_id=8286
>> > Geo.
>> > "Ellen K." <72322.1016@compuserve.com> wrote in message
>> > news:mrt0h0t8hal9s77otdo9fa3p8do8g2ctcr@4ax.com...
>> >> Does anyone get the bugtraq letter that reports on Oracle stuff?   (I
>> >> only get the NT one.)  Apparently David Litchfield revealed a whole
>> >> bunch of Oracle vulnerabilities at the Black Hat thing... one of our
>> >> directors sent an email mentioning a WSJ article about it to my boss,
>> >> who asked me to follow up... blabla googling around I read that
>> >> yesterday's bugtraq letter carried a lot of information but I can't find
>> >> anything on the SecurityFocus site.
>> >>
>> >> PLEEZE if you get or can get this, send it to me at work, if you need my
>> >> work email post here that you have it and I will send you my work email
>> >> address...  or just post the whole thing here.
>> >>
>> >> Conflicting reports, but apparently multiple different flavors of
>> >> vulnerabilities from our favorite the buffer overflow to problems in
>> >> PL/SQL.
>> >>
>> >> Thanks in advance.   :)

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)