Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

The second IOUG / Oracle Security Assurance Survey

July 27th, 2010 by Pete

I wrote about the first IOUG joint security survey with Oracle two years ago here in my blog in a post titled "An Oracle Security Survey by The IOUG and Oracle" and I encouraged participation on the survey. The second survey is now available now. The survey is worth while as its your chance to influence the security assurance team within Oracle and also to help get some idea of whats going on in the community. The offiial text for the survey is:

Oracle and the Independent Oracle User Group (IOUG) are launching a new security assurance survey. The purpose of this survey http://ioug.itconvergence.com/pls/apex/f?p=201:19:2332809242507089::NO - (broken link) is to gather feedback from as many organizations as possible about their security patching practices and to identify which security assurance topics are most relevant to Oracle customers.

The IOUG participates in Oracle’s Secure Customer Advisory Council and has worked with Oracle Global Product Security on this survey which will provide meaningful feedback to Oracle about its security programs. For example, the current survey provides respondents with a chance to give feedback about Patch Set Updates (PSUs) and the CPU documentation. Survey responses will be kept confidential, and the results will be analyzed jointly by Oracle and IOUG to evaluate Oracle’s security assurance practices The survey is located here http://enterprisesig.oracle.ioug.org/ (free SIG membership is required to access the survey).

As I did two years ago I encourage everyone to take part and add some influence to the security patching process. Thanks!

59 Security bugs fixed, 28 remotely expolitable, 13 in the database

July 14th, 2010 by Pete

Oracle yesterday released the latest in its series of quarterly security patches known as CPU's Critical Patch Updates. Oracle released an advisory detailing the fixes. The patch set contains 59 new security fixes. For me the interesting part are the fixes for the database; 13 in all, 6 of which are for the database server itself and 4 of which may be expolited remotely without authentication. The other interesting thing is the amount of names credited on the advisory. i have not counted but its probably the most i can remember. what does this actually mean?, on the simplest level it means many more people are now interested in and doing someting about database security which has to be a good thing. As always Oracle recommend that you apply this as soon as you can. With remotely exploitable bugs / vulnerabilities this should be obvious.

Pete Finnigan will be teaching Oracle Security in Tallinn, Estonia and speaking at UKOUG Unix SIG at TVP

July 7th, 2010 by Pete

I have just added another public training date to my upcoming Oracle security trainings calendar. This is for November 4th and 5th in Tallinn, Estonia which I am really looking forwards to.

I have also just agreed to do two 45 minute presentations at the up-coming UKOUG Unix Sig at Oracle in Readings Thames Valley park on September 8th 2010. The talk will be based on two major areas; the first is understanding the true risk to your data, where the data is and how easy it is to steal in the real world. The second is looking at how to assess the access to your data. The talk is also split into two sections so should be fun. There will be lots of demos and real world experience.

Do Oracle 11g features weaken security?

July 1st, 2010 by Pete

I did a session at the Logica Guru4Pro event a few weeks ago and posted the slides to my site on my Oracle security white papers page. I also talked about this in my blog in a post titled "New Oracle Security presentation available".

After that post Alex skyped me to ask me what I meant in slide 33 where i said "11gR1 has broken this with the default sid/service name feature". In slide 33 i am talking about what i call the "Access Issue", i.e. to access a database at the TNS level, say through SQL*Plus you need certain information; IP Address/Hostname, port, service name/SID, usrername/password. In real life most sites make this information available simply by shipping some of this information to the desktop. Most sites I have been to, usernames and passwords are guessable so in most cases its easy (if you try) to connect to a database.

If one of the peices of information; the service name is no longer necessary then in my opinion that reduces the security of the database in that it makes it easier for anyone to attempt access. When Alex skyped me i described the meaning of this to him but couldnt find a link. Alex skyped me again last night to say he had found a link. The DEFAULT_SERVICE_{listener name} expects a fully qualified service name. This parameter of the listener.ora file is not turned on by default. So by default 11g security is not weakened. If you use this new parameter you are weakening security of your database as you are allowing people to attempt to connect without finding out one of the key peieces of information necessary to do so.