Paul emailed me the other day to send his new paper that shows how he was able to exploit a problem with Oracles namespace resolution. The idea is that because a user may have the CREATE USER privilege so he can create a database user with the same name as a SYS owned package. In the example Paul creates a user called DBMS_FLASHBACK. The namespace resolution and the fact that SYS ignores definer rights code means that the creation of a function from a package (the same name as a real function) can be used to call code to grant SYSDBA to the attackers user through his function.
Its a nice idea but the execution is really a trojan as its still necessary for a DBA logged in as SYSDBA to execute the "doppleganger" function. Nice idea though.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Latest Oracle CPU is out"] [Next entry: "Pete Finnigan webinar "The right way to secure Oracle""]
July 2009
- A new database security auditing and scanner product, some BBED, ASM and AV - 07/06/2009 by 07/06/2009
- Poor mans database vault - 07/08/2009 by 07/08/2009
- Latest Oracle CPU is out - 07/15/2009 by 07/15/2009
- Escalate privileges to SYSDBA with CREATE USER - 07/16/2009 by 07/16/2009
- Pete Finnigan webinar "The right way to secure Oracle" - 07/21/2009 by 07/21/2009
- Rogue DBAs: Hidden Inside Security Threat - 07/22/2009 by 07/22/2009
- Hacking Oracle made easy - 07/24/2009 by 07/24/2009
Archives
Syndication
Powered by gm-rss 2.0.0
