Archive for Juli, 2007

Oracle Critical Patch July 2007 will fix 46 vulnerabilities

Donnerstag, Juli 12th, 2007

Oracle announced on their webpage that the upcoming CPU will fix 46 vulnerabilities. 20 vulnerabilites in the database (including 1 bug in APEX). The APEX vulnerability is already fixed in APEX 3.0.1.

The highest CVSS rating for the 4.8 which is quite high.

Our upcoming vulnerabilities are available on our website.

More details next tuesday.

He that is without sin among you, let him first cast a stone at her

Montag, Juli 9th, 2007

On Tom Kyte’s blog , Pete Finnigan’s blog and Sven Vetter’s blog there are comments about SQL Injection in a bank application.

I know that SQL Injection is a big problem and especially the vulnerability in this banking application was really severe. But in the real world most developers write (or at least wrote) unsecure code. Often they use (unsecure) samples from books. But who is writing the books?
Why do you blame this poor little bank. Don’t throw the first stone…
Let’s do some quick check how secure the code from other people or companies (e.g. intelligence agencies) is…

Expert One-on-One by Tom Kyte from 2001. 2 years after SQL Injection became public.
p. 707:
create or replace
function update_row (p_owner in varchar2, p_newDname in varchar2, p_newLoc in varchar2, p_deptno in varchar2, p_rowid out varchar2)
return number
l_theCursor integer;
l_columnvalue number default NULL;
l_status integer;
l_update long;
l_update := ‚update ‚ || p_owner || ‚.dept
set dname = :bv1, loc = :bv2
where deptno = to_number(:pk)
returning rowid into :out‘;
l_theCursor := dbms_sql.open_cursor;
More code with SQL Injection (not complete I just skimmed through the book):

p710: execute immediate ’select count(*) from ‚||p_tname‘
p710: execute immediate ‚update ‚||p_owner||‘.dept…‘

p712, p724, p726, p727, p728, p729, 1087. I stopped her…
Oracle Database 10g – The complete reference by Kevin Loney

page 577

Oracle Security in der Praxis by Frank Haas (German Oracle Security Book from a nice and clever Oracle Consultant)

page 139, 140

Effective Oracle Database 10g Security by design by David C. Knox

page 30

Database Security Technical Implementation Guide STIG V7.2, by the DISA (Defense Information Systems Agency responsible for DOD systems)
page 186 plus some more


page 1,2,4

Will be continued…

checkpwd 1.23 for MacOS

Montag, Juli 2nd, 2007

I just uploaded checkpwd 1.23 and sidguess for Mac OSX. The executables are for PPC only because Oracle has only a PPC version of the Oracle Instant Client.


Screenshot Checkpwd Mac


Sidguess Mac