Archive for April, 2010

Blackhat 2010 Presentation „Oracle, Interrupted: Stealing Sessions and Credentials“ online

Sonntag, April 18th, 2010

 The Blackhat Europe 2010 „Oracle, Interrupted: Stealing Sessions and Credentials“ (presentation, whitepaper) of Steve Ocepek and Wendel G. Henrique are online. An interview with Steve about the talk can be found here.

As mentioned in a previous blog post this talk  shows how to intercept unencrypted (=default) TNS connections and inject statements into a running session. Steve and Wendel will soon release 2 tools Vamp and thicknet.

I will try to present these tools at the DOAG Expertenseminar in Berlin.

DOAG Expertenseminar

A good summary of the talk can be found at Peter Van Eeckhoutten’s blog.

New fast Oracle DES password cracker OPS_SSE2

Donnerstag, April 15th, 2010

Dennis Yurichev has released a new password cracker (brute-force) called ops_sse2 for Oracle DES passwords.  This password cracker is the fastest brute force cracker for Oracle DES passwords and approx. 3 times faster than woraauthbf from Laszlo Toth.

Here a quick comparision on my Quad2Core (2.4 GHz):

OPS_SSE2

Password length (8 character) (only characters) can be cracked  in approx 3 hours. For numbers and characters it takes approx. 2.5 days for a single password.

Impressive work…

Oracle 11g R2 client trojan warning from Antivir

Mittwoch, April 14th, 2010

I just came across a forum entry on OTN „Possible trojan with 11gR2 Windows 32-bit client on OTN?„. It seems that some virus scanners are reporting a potential trojan in the 32bit client of Oracle 11R2.

According the Eric Maurice from the Oracle security team it is a false positive of the Avira Antivir scanner engine.

It is good to know that also large software vendors are running in this problem of false positives. This can be really bad for the reputation of a software vendor.

Python Source for PLSQL Unwrapper posted

Dienstag, April 13th, 2010

Niels Teusink has posted a Python script to unwrap PL/SQL code (10g+ only). This python script can unwrap code on the command line.

More details are available in the blog entry of Niels.

This is a better solution than the online unwrapper.

Oracle CPU April 2010 is out

Dienstag, April 13th, 2010

Oracle just released the Oracle CPU (and PSU) for April 2010. As mentioned in a previous blog post this CPU contains 7 new security vulnerabilities.  7 new security vulnerability fixes. None of these vulnerabilities are remote exploitable without authentication.

The highest CVSS base score for the Oracle database is 7.5 (Oracle Fusion Middleware). It seems that the Java 0day from David Litchfield is also fixed. But I have to download the Oracle patches to verify that all bugs are fixed.

The following components are affected:

• Change Data Capture
• Core RDBMS
• JavaVM
• Oracle XDB
• RDBMS Security
• XML DB
• Audit

DOAG Expertenseminar

This time all Oracle vulnerabilities are coming from the usual suspects:
Okan Basegmez of DORASEC Consulting; Esteban Martinez Fayo of Application Security, Inc.; Joxean Koret; Alexander Kornbrust of Red Database Security; David Litchfield formerly of NGS Software; Oleg P. of HSC Security Portal; and Alexandr Polyakov of Digital Security.

Oracle has fixed a problem (CVE-2010-0854) I reported in January 2009. It is possible to bypass Oracle Auditing using explain plan. Within the next few days I will release an advisory for this problem.