an American computer technology company based in California. Oracle specialize in computer hardware and enterprise software products including it's own brand RDBMS, along with MySQL and Java as a result of purchasing Sun Microsystems.

learn more… | top users | synonyms

0
votes
0answers
3 views

Does CyberArk work with Oracle Dataguard? [migrated]

Does anyone have experience setting up CyberArk password rotation for oracle databases that use DataGuard. the problem Im running into is that the secondary database is not open, so i need a way to ...
0
votes
1answer
67 views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
31 views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
1
vote
0answers
110 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
1answer
49 views

Difference between Oracle Label Security and Oracle Virtual Private Database?

I am working on a class project, and our lecturer ask a question with this title, I searched in net but I could not find a clear answer. if there is difference what are they? thanks
0
votes
1answer
17 views

Number of certificates in a PKCS#12 archive

Is there command to find the number of certificates in a PKCS#12 archive? I have the .pfx file sent by a client but need to find out how many certificates it contains. I don't need any of the ...
1
vote
1answer
214 views

How can I securely delete items in a database?

I know that to securely delete files on a system I have to apply some kind of secure deletion (overwritting empty clusters, for example). But when I want to delete some information on a database ...
0
votes
1answer
68 views

What are the reasons behind Oracle password restrictions?

Oracle presents a fairly restrictive password policy: Passwords can be from 1 to 30 characters. The first character in an Oracle password must be a letter. Only letters, numbers, and the ...
5
votes
2answers
102 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...
2
votes
2answers
137 views

Stop POODLE vulnerability in Oracle Application Server

Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know ...
1
vote
1answer
128 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
2
votes
3answers
338 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
1
vote
1answer
189 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
1
vote
1answer
328 views

How to disable x-oracle-dms-ecid cookie

During a security audit, our cliente found that we are sending to the cliente a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
5
votes
1answer
3k views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
0
votes
1answer
253 views

oracle weblogic vulnerability

I searched for Oracle Web logic vulnerabilities and found this vulnerability: Oracle WebLogic Server Cross-Site Scripting and Manipulation of Data Vulnerabilities ...
4
votes
1answer
160 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
-9
votes
1answer
106 views

Random Oracle existence and real world

I am looking at oracle security. What is a random oracle? Does a random oracle exist? How is the random oracle behavior approximated in the real world?
1
vote
1answer
116 views

Oracle database privileges [closed]

I have a 10.2.0.5.0 Oracle Database and a list of users who i need to grant some privileges to (Mainly to generate reports and so on). I used impersonation, which means i created one Oracle user so ...
8
votes
2answers
1k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
-1
votes
2answers
7k views

Want to authenticate oracle login using encrypted password…how to?

We are connecting to Oracle using korn shell scripts, which use sqlplus to connect to Oracle. The Oracle database is on the same Solaris box. Currently, we are storing the Oracle user id and ...
4
votes
4answers
1k views

How to protect against “padding oracle attacks.”

I need to encrypt something on my server and save the result. Since I am not a security expert, I want to implement as much existing code as possible. I found a fully build function on php.net but ...
4
votes
3answers
1k views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
5
votes
2answers
1k views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
2
votes
4answers
1k views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
6
votes
1answer
470 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
1
vote
1answer
336 views

Is Oracle gathering information from my machine when I download Virtualbox or Netbeans?

When we try to download Netbeans or Virtualbox from the Oracle/Sun site, our firewall warns us that some suite called EdgeSuite tries to obtain information from our machines. I don't know what ...
5
votes
1answer
1k views

Oracle ExaData Security best practice

Does anybody have experience with Oracle ExaData Security? Client wants to move all of his Oracle DB to central Oracle ExaData server. So on same machine will be hosted DBs of different vendors and ...
5
votes
2answers
384 views

Oracle Internet Directory (OID) hardening

What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory? note: OID is compatible with LDAP version 3.
7
votes
1answer
606 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
1
vote
1answer
505 views

OpenSSO and Basic Auth together

Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
13
votes
1answer
997 views

Is there a list of default, standard or third-party “users” for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of ...
10
votes
2answers
2k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...