I posted about the Blackhat DC conference that is coming up soon a few days ago in a post titled "Oracle 0-day exploit to be released - Blackhat Washington DC database security presentations" and talked about David Litchfields presentation and surmised what it may be about. Well David will talk about a new Oracle attack vector that involves http://www.databasesecurity.com/dbsec/cursor-snarfing.pdf - (broken link) dangling cursors and will show how a user with only CREATE SESSION privileges can execute any SQL, PL/SQL or DDL in the database. This is quite a cool attack technique.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Hacking Oracle, but not in English"] [Next entry: "11i Security papers available"]
February 2007
- Users and Schemas - 02/02/2007 by 02/02/2007
- Detecting rootkits - 02/05/2007 by 02/05/2007
- Oracle Database Vault is certified with PeopleSoft - 02/07/2007 by 02/07/2007
- Where's Larry? Ellison calls out sick at RSA Conference - 02/08/2007 by 02/08/2007
- Argeniss are now selling Oracle rootkits! - 02/12/2007 by 02/12/2007
- Oracle 0-day exploit to be released - Blackhat Washington DC database security presentations - 02/15/2007 by 02/15/2007
- Oracle TNS Protocol downgrade attacks - 02/16/2007 by 02/16/2007
- Hacking SYS password added as a pdf - 02/18/2007 by 02/18/2007
- Hacking Oracle, but not in English - 02/20/2007 by 02/20/2007
- More on Oracle hacking techniques - 02/23/2007 by 02/23/2007
- 11i Security papers available - 02/25/2007 by 02/25/2007
- New paper: Cursor injection - attacking Oracle with just CREATE SESSION - 02/27/2007 by 02/27/2007
Archives
Syndication
Powered by gm-rss 2.0.0
