Pete Finnigan's Oracle Security Weblog

I had a conversation with someone on email over a few days last week about exploits that could be demonstrated against version 7 and 8 databases still in production that could not be patched for alert 68. What they wanted to do was demonstrate whether these versions are still affected by the alert but cannot be patched. The conversation was about revealing knowledge of exploits that could then be used to demonstrate whether there is an issue. This conversation got me thinking later about the Oracle exploits that are public - e.g. exploit code can be found somewhere on the net. There are a number of locations on the net that include exploit code for Oracle software such as the Packet Storm website. Some of the commercial scanners such as Application Security Inc's AppDetective and NGS Softwares Squirel include implicit knowledge of some exploits if not as such divulging the actual exploit to the public. Free tools such as Nessus also include checks for Oracle security issues. With Nessus you can examine the code and see that in a lot of cases a check to see if the software is exploitable is done simply by checking versions. What about when someone wants to be sure about whether their installation is vulnerable? - The only way sometimes is t use real exploits.

So it got me thinking about adding some links to known Public Oracle exploit code on my site. Then another thought crossed my mind - To do so would involve adding a new menu item again and that would mean me power editing all the existing pages. So i started to think about whether I could use blog software as a content management system for the whole of my web site. I am using http://www.noahgrey.com/greysoft/ - (broken link) greymatter now for this web log and as its template based i should be able to use it to generate pages for my existing site so making it easier to extend the structure of the static part of the site and also to add content. So i have spent a couple of hours reading about greymatter templates in more detail this evening - It makes a change from surfing for Oracle info. :)....

Anyway now I am considering whether it’s worth learning more about greymatter templates and converting the whole site or indeed using another blog software such as Movable Type. It is really down to whether it’s a better use of my time to bite the bullet and learn the templates or to simple power edit. I will add an exploits page to my site in the next few days to link to the publicly known exploits that I known about. I think this could be useful for those interested in Oracle security.