close
Welcome! Wikis are websites that everyone can build together. It's easy!

Location: Database Security

Discussion: Oracle 0-day to get SYSDBA access

Keyword tags: authentication Hardening Security SYSDBA

Watch

Anonymous  (Get credit for your thread)
wgblack3
wgblack3		 Oracle 0-day to get SYSDBA access
Nov 13 2007, 1:13 PM EST
Will Oracle release a patch for this?

Tanel Poder has found a way to get SYSDBA access to the Oracle database by utilising a user who has the BECOME USER system privilege, execute privileges on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user with these privileges can become SYS (but not SYSDBA) and then use an immediate debug event to cause a debugger to flip the SYSDBA bit in the PGA to set a dedicated server session to an SYSDBA one, from there the user can do anything else. The user needs to have these privileges so its not an open and shut case but serious in that a privilege escalation is still possible. Tanels post is here http://blog.tanelpoder.com/2007/11/10/oracle-security-all-your-dbas-are-sysdbas-and-can-have-full-os-access/ and my blog entry / analysis is here - http://www.petefinnigan.com/weblog/archives/00001126.htm

 3  out of 5 found this valuable. Do you?    

Sign in to be the first to reply.

Related Content

  (what's this?Related ContentThanks to keyword tags, links to related pages and threads are added to the bottom of your pages. Up to 15 links are shown, determined by matching tags and by how recently the content was updated; keeping the most current at the top. Share your feedback on Wetpaint Central.)
Setting Listener Password OSBJMSSecurityExample JRuby on Rails: Oracle SSO Integration
Authentication: Database vs Application Database Security Links to Oracle Security Docs
Oracle 0-day to get SYSDBA access