Sponsored Links

 

 

 

60 Oracle Security Tips in 60 Minutes

Source: www.seouc.com
Topic: Oracle Programming


Short Desciption:
Understand Exploits • What : Oracle exploits are available for review and experimentation • Why : Understanding and demonstrating exploits can raise data security awareness • How

 

Content Inside:
60 Oracle Security Tips in 60 Minutes SEOUC 2007 Kenny Smith (and Trish Holliman, Igor Ryzhkov & Bob Vance) Understand Exploits • What : Oracle exploits are available for review and experimentation • Why : Understanding and demonstrating exploits can raise data security awareness • How : Find exploit information and play with hacks on test databases • Where : -Aaron Neumans"Anatomy of a Database Attack" -Review www. red - database - security .comsite -Badstore.net, CAIN, password crackers Tip #1 of 60 Hijack a Users Account • What : A users password hash can be captured from DBA_USERS or export file. Someone with ALTER USER privilege can change the password, do some work, then replace the password using the hash • Why : Misuse can occur as a trusted user without that users detection • Where : See - www.pentest.co.uk/documents/ora_pwd_thorts .htm - http://asktom.oracle.com for "Password in DBA_USERS" Tip #2 of 60 Hijack a Users Account SELECT password FROM dba_users WHERE username = SCOTT; ALTER USER scott IDENTIFIED BY hijack; CONNECT scott/hijack GRANT SELECT ON scott.emp to PUBLIC ALTER USER scott IDENTIFIED BY VALUES 23E3F8C1BB14BB4 D; Tip #2 of 60 Hijack a Users Account •To prevent and detect this attach: *Limit user access to the DBA_USERS view *Audit database changes like user password alterations or escalation of privileges *Prevent commands by being run via PRODUCT_USER_PROFILE table entries. Tip #2 of 60 Automate Database Assessments • What : Examine your database for vulnerabilities • Why : Helps you catch problems • How : Automated options include: -Oracle Enterprise Manager (Configuration Pack) -Application Securitys AppDetective -Center for Internet Security Benchmarking tool • Where : See these sites - www.oracle.com/technology/products/oem/pdf /ds_as_cmp_r2.pdf - www.appsecinc.com - www.cisecurity.org • Note : Find da ...

 

add to Google Reader add to Google Bookmark add to bloglines add to newsgator add to FURL add to digg add to webnews add to Netscape add to Yahoo MyWeb add to spurl.net add to diigo Bookmark newsvine Bookmark del.icio.us Bookmark @ SIMPIFY Bookmark MISTER WONG Bookmark Linkarena Bookmark icio.de Bookmark oneview Bookmark folkd.com Bookmark yigg.de Bookmark reddit Bookmark StumbleUpon Bookmark Slashdot Bookmark blinklist Bookmark technorati add to blogmarks add to blinkbits add to ma.gnolia add to smarking.com add to netvouz add to co.mments add to Connotea add to de.lirio.us

 

Related PDF Files

Oracle Application Server Forms and Reports Services


Topic: Oracle Programming

... Oracle Application Server Forms Services Deployment Guide ■ Oracle Forms Migration Guide ■ Oracle Application Server Reports Services Publishing Reports to the Web ■ Oracle Application Server Concepts

Oracle Database 2 Day + Performance Tuning Guide


Topic: Oracle Programming

Oracle® Database 2 Day + Performance Tuning Guide 10 g Release 2 (10.2) B28051-01 November 2006 Easy, Automatic, and Step-By-Step Performance Tuning Using Oracle Diagnostics Pack, Oracle Database ...

Oracle SQL*Net and Net8 Malformed Packet Denial of Service ...


Topic: Oracle Programming

Oracle SQL*Net and Net8 Malformed Packet Denial of Service Vulnerability Overview A potential security vulnerability has been discovered in Net8 (formerly known as SQL*Net). The Oracle8i database ...

Installing Oracle 9i release 1 RAC on Windows/2000


Topic: Oracle Programming

Miracle A/S Technical Note #3 17-Jan-2003 Page 1 of 5 Installing Oracle 9i release 1 RAC on Windows/2000 This technical note gives some hints and tips on installing Oracle Real Application Clusters, 9 ...

Oracle Database Expression Filter User’s Guide and Reference


Topic: Oracle Programming

Oracle® Database Application Developers Guide - Expression Filter 10 g Release 1 (10.1) Oracle Database Expression Filter User’s Guide and Reference

 

Sponsored Links