4

I have a Windows Server 2008 R2 with an Oracle database running on it.

Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can control the whole server and do whatever he wants.

Is it possible to do so? Sound incredible to me.

Improve this question
5

You can execute shell commands in PL/SQL is the scenario here. These will run with the privilege of Oracle, which might be LocalSystem. Obviously you will want to secure against this by restricting privileges to create stored procedures, running Oracle as a less-privileged user, and so on.

Once someone has an account then it’s the same as any other breach, they can do anything their new account can do.

Improve this answer
1
  • Oracle users do not by default have privileges to do this - these would have needed to be granted to the user (as in the example pointed to). This is a good example for why you should use Least Privileges when granting privileges and running with the lowest privileges. – Egret Sep 20 '19 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.