Today I downloaded a new Oracle Security book from Syngress: „Practical Oracle Security„. Here a short review:
Downloading the ebook was quick and easy. The annoying thing was the password query every time I opened the ebook. To get rid of the password I opened the PDF file in Adobe Acrobat, removed the password protection and that’s it… Syngress forgot to protect the PDF file properly.
First I skimmed through the book and it looks quite nice in the beginning but then I found more and more problems and inaccuracies. Some of the recommendations from the book make your database even more insecure.
Here an incomplete list of some potential problems and inaccuracies:
p. 43: Some older versions of dbms_system.ksdwrt are vulnerable against a buffer overflow. This could cause a database crash. This is not mentioned. Playing around with dbms_system.ksdwrt could crash your database.
p.58: Providing read access (711) to the listener.ora is not a good idea because this file contains the password hash of the TNS listener.
p.74: Recommendation to set a long and strong listener password in 10g. This makes the listener configuration more insecure because it opens remote administration if the password is known!!! The combination password and local os authentication is in my opinion not useful. I would recommend to use local OS authentication alone OR set a strong password together with disabling local OS authentication.
p.108: Using impossible passwords introduces a security risk because all versions until 10g R.2 are resetting a default password from time to time. Unlocking databases accounts introduces a big security hole because a default account gets a default password. Problem is reported to Oracle but still unfixed.
p. 139: Important and powerful packages like utl_inaddr (send sensitive data via DNS) or dbms_advisor (write files to OS) are not mentioned in the ebook
p.139: Description of execute any procedure is wrong. Exploits are only working if the o7_dictionary is set to non-default value
p.140: Description of select any table is wrong.
p.170: … if a 0day exploit exists on the internet, Oracle will generally release a security alert rather than waiting for the next scheduled CPU. This is not true (see for example exploit dbms_export_extension or create view problem). Oracle will only release out-of-order patches if an exploit is available on the internet AND the bug is critical AND will be exploited
p.180: Recommends to enable account lockout. This is a conflict with the impossible and unlocked database accounts. Account lockout could also lead to a D.o.S. against application user accounts (e.g. used in AppServer)
p. 209: Blank Oracle passwords? Tell us more…
p.210: How can you read a file with utl_file only? Without directory traversal (fixed in all supported patchsets) and without „create any directory“?
p. 211: The famous blank password again…
p.232: utl_udp is not an oracle package. It’s a package posted on USENET.
p.232: Packages such as utl_file. utl_http, … give access to the host’s operating system including the file system and network. ==> this is not correct.