Laszlo Toth has released a new paper on the details of the changes between 8i, 9i and 10g Oracle native authentication including detailing some of the weaknesses and also including some proof of concept code. The paper shows that the authentication in all three versions of the protocol is subject to brute force or easy decryption of the password if a session can be sniffed and the AUTH_SESSION and AUTH_PASSWORD can be grabbed. The paper is titled "Oracle native authentication version 9i and 10g" and is available from Laszlo's site and is worth reading.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "A new Oracle security blog in English and German and some Oracle security videos"] [Next entry: "Software should defend itself: Oracle CSO"]
May 2007
- Pete Finnigan UKOUG Leeds April 2007 slides available - 05/03/2007 by 05/03/2007
- Pete Finnigan to speak about Oracle security - 05/06/2007 by 05/06/2007
- Oracle audit vault is available for trial download - 05/09/2007 by 05/09/2007
- Getting started with Oracle security - 05/11/2007 by 05/11/2007
- Oracle BI Suite and Row Level Security - 05/15/2007 by 05/15/2007
- Oracle forensics part 4 - live response - 05/17/2007 by 05/17/2007
- 15 free SQL Injection scanners - 05/20/2007 by 05/20/2007
- UKOUG Unix Sig - Hacking and Securing Oracle - 05/21/2007 by 05/21/2007
- A new database security blog talks about propogating middle tier and application user identities - 05/24/2007 by 05/24/2007
- A new Oracle security blog in English and German and some Oracle security videos - 05/28/2007 by 05/28/2007
- David Litchfield announces Open Software Database forensics toolkit - 05/29/2007 by 05/29/2007
Archives
Syndication
Powered by gm-rss 2.0.0
