Pete Finnigan's Oracle Security Weblog

I was made aware of a paper on SQL Injection specifically aimed at Oracle databases today. The paper written by Stephen Kost is an excellent description of the problem of SQL Injection in Oracle. This paper is very well written and starts by discussing what is SQL Injection, how does it work what are the types of SQL Injection - SQL manipulation, code injection, function call injection and buffer overflows.

Stephen covers injection using PL/SQL and JDBC as these are the most common API's used with Oracle based applications. He talks about the fact that there is a bigger risk to Oracle databases from injection than first thought and also covers the basic ways to protect against SQL Injection even covering where these basic ways will not work. The two ways are to use bind variables and also to filter the input strings specifically for single quotes. Stephen points out that there are cases where bind variables cannot be used such as when the dynamic SQL or PL/SQL needs to generate table names, column names or procedure/function names. He also covers the issue of error message reduction as this is a way that attackers can learn about how an application works so they can exploit it.

This is a very thorough discussion of the subject in relation to Oracle and covers how SQL Injection works and how to secure it. Even the reference section is thorough. Again the paper is here and is well worth reading.