Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Chris was also talking about Alex's 42 bugs found in Metalink"] [Next entry: "Steve has added an undocumented sample for fixed JDBC credentials"]

Alex has released his paper on metalink hacking

I have just had an email from Alex Kornbrust who has let me know that his Metalink hacking paper has been released today. The paper is titled "Metalink Hacking" and is available on Alex's white papers page. The paper gives some background and details on Alex's investigations into using Google hacking techniques against the Oracle metalink repository. Alex starts by telling us about the 42 security bugs he found and then gives some general background information to how metalink is used and what it is. he then details some of his searches and the results he found in some cases including security bugs. Alex finishes with some guidelines on what is a security bug in Oracles eyes and goes on to look at some denial of service issues. Finally he gives some hints for customers and Oracle employees on using metalink more safely.

This is an excellent paper that covers some unusual ways of finding security bugs in Oracle.