Location: Database Security

Discussion: Oracle 0-day to get SYSDBA accessReported This is a featured thread

Category: Discussion Forum / General Discussion
Showing 1 post
wgblack3
wgblack3
Oracle 0-day to get SYSDBA access
Nov 13 2007, 1:13 PM EST | Post edited: Nov 13 2007, 1:13 PM EST
Will Oracle release a patch for this?

Tanel Poder has found a way to get SYSDBA access to the Oracle database by utilising a user who has the BECOME USER system privilege, execute privileges on KUPP$PROC.CHANGE_USER and CREATE SESSION. he shows how a user with these privileges can become SYS (but not SYSDBA) and then use an immediate debug event to cause a debugger to flip the SYSDBA bit in the PGA to set a dedicated server session to an SYSDBA one, from there the user can do anything else. The user needs to have these privileges so its not an open and shut case but serious in that a privilege escalation is still possible. Tanels post is here http://blog.tanelpoder.com/2007/11/10/oracle-security-all-your-dbas-are-sysdbas-and-can-have-full-os-access/ and my blog entry / analysis is here - http://www.petefinnigan.com/weblog/archives/00001126.htm

 4  out of 6 found this valuable. Do you?    

Sign in to be the first to reply.

Related Content

  (what's this?Related ContentThanks to keyword tags, links to related pages and threads are added to the bottom of your pages. Up to 15 links are shown, determined by matching tags and by how recently the content was updated; keeping the most current at the top. Share your feedback on Wetpaint Central.)
The Top 10 Web Application security vulnerabilities starting with XSS ADF Security Why companies are not using EM Grid Control
Securing Your PeopleSoft Application - Wiki as Red paper AD Authentication? Oracle Italy Technology Insight Program
Setting Listener Password OSBJMSSecurityExample JRuby on Rails: Oracle SSO Integration
Authentication: Database vs Application Database Security Links to Oracle Security Docs