Questions tagged [oracle]

an American computer technology company based in California. Oracle specialize in computer hardware and enterprise software products including it's own brand RDBMS, along with MySQL and Java as a result of purchasing Sun Microsystems.

Filter by
Sorted by
Tagged with
1
vote
1answer
43 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
4
votes
1answer
97 views

Is it possible to take over a Windows server through Oracle?

I have a Windows Server 2008 R2 with an Oracle database running on it. Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can ...
0
votes
2answers
74 views

TDE - Encrypting different rows with different keys

My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company ...
3
votes
1answer
290 views

Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?

We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
8
votes
3answers
3k views

Can .ova file contain an exploit?

Is it possible to prepare an .ova file for Oracle Virtualbox that will access NAT network when is set to use Whonix? There are preconfigured virtual machines like Windows to use in Whonix, but are ...
0
votes
1answer
450 views

Verifying Encryption at Rest with Oracle 11g

I have a big giant database that is basically human resources related. As such, it contains all the PII in the world (SSN, medical related stuff, bank payment info, etc). If you do not request PII ...
0
votes
0answers
348 views

CSRF vulnerability in Oracle ADF web application

I am pentesting Oracle ADF web application. One of the requests to delete some content consists of parameters like _adf.ctrl-state and javax.faces.ViewState, which seem to be random numbers, active ...
8
votes
3answers
1k views

Are encrypted Cookies vulnerable to Padding Oracle Attacks

I'm currently helping write a fast compiled web framework in the crystal language and am trying to find a way to speed up sessions using encrypted cookies. We're currently taking a json string and ...
1
vote
1answer
549 views

Understanding Oracle 11g password hashing algorithms

I'm trying to understand the Oracle 11g password hashing algorithm, I found this link explaining how it is done, however, I have some confusion on how they say it's done. According to that link it ...
4
votes
2answers
153 views

Do I have to change my database user password in this situation?

Ok I know this is a stupid question but our one and only DBA get into a mess with our manager and rage quit today. As a small company, I (IT support guy who knows nothing about DB) was told to change ...
4
votes
1answer
3k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
1
vote
2answers
144 views

Why Oracle says following deserialization vulnerabilities are related to HTTP protocol?

According to Oracle website, following deserialization vulnerabilities are related to HTTP protocol. CVE-2015-7501, CVE-2016-5535, CVE-2016-3586, CVE-2016-3510, etc. But I do not understand why ...
1
vote
0answers
81 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...
1
vote
1answer
2k views

OpenSSL oracle padding vulnerability (CVE-2016-2107)

Hi We have a Windows 2008R2 SP1 server system running Oacle with OpenSSL. Upon doing a security scan we have found out that we are getting: OpenSSL oracle padding vulnerability(CVE-2016-2107) ...
3
votes
2answers
120 views

Is there a risk of using AEAD encryption algorithms when the key is generated from a password?

I need to encrypt something on a smartphone. The data is relatively small and would be stored encrypted on the phone. I was thinking AES-GCM with a key generated by a password (chosen by the app's ...
4
votes
1answer
431 views

What is the best practice for giving Oracle DB credentials to a Java Application?

I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications? I came ...
2
votes
1answer
6k views

Using TLSv1.2 on Weblogic server for outgoing transactions with IBM JDK [closed]

I am trying to use TLSv1.2 for all communications going out from my Weblogic application server(acting as SSL client) but couldn't use it. System details: Weblogic 12c IBM JRE7 SR9 Things I have ...
1
vote
1answer
256 views

Executing XSS on .jsp page by escaping string and with raw bytecode?

Assume that a java (.jsp) page takes a from input as a string, the server does nothing to sanitize it, and then echoes it back to the user. How would an attacker escape the string to execute ...
1
vote
1answer
1k views

How do I know if a Nessus Scan against a Oracle instance has been sucessful?

I have a Nessus Policy with all the Oracle plugins activated and the rest of the plugins disabled. I ran the scan against a fresh installation but I get nothing but the Oracle TNS Listener Remote ...
1
vote
0answers
147 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
21
votes
3answers
369 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
3
votes
4answers
2k views

How Likely Is It For A Virus To Spread From A Linux VM To The Windows Host

I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it ...
0
votes
1answer
366 views

Virtual Machine Introspection for VirtualBox

Is possible use Virtual Machine Introspection (VMI) for monitoring system calls and internal system operations in Oracle VirtualBox machine (if I use Linux as quest system) in this time? I have read ...
2
votes
1answer
60 views

is there a workaround for CVE-2015-2625?

we are not able to upgrade jdk 6 to jdk1.8u51 where this issue (CVE-2015-2625) is fixed. is there a workaround one can have until we migrate to jdk1.8?
4
votes
1answer
587 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar [...
1
vote
1answer
5k views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
802 views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
1
vote
0answers
927 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
1answer
620 views

Difference between Oracle Label Security and Oracle Virtual Private Database?

I am working on a class project, and our lecturer ask a question with this title, I searched in net but I could not find a clear answer. if there is difference what are they? thanks
0
votes
1answer
39 views

Number of certificates in a PKCS#12 archive

Is there command to find the number of certificates in a PKCS#12 archive? I have the .pfx file sent by a client but need to find out how many certificates it contains. I don't need any of the ...
2
votes
1answer
3k views

How can I securely delete items in a database?

I know that to securely delete files on a system I have to apply some kind of secure deletion (overwritting empty clusters, for example). But when I want to delete some information on a database (...
0
votes
1answer
790 views

What are the reasons behind Oracle password restrictions?

Oracle presents a fairly restrictive password policy: Passwords can be from 1 to 30 characters. The first character in an Oracle password must be a letter. Only letters, numbers, and the ...
6
votes
2answers
132 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...
1
vote
2answers
254 views

Stop POODLE vulnerability in Oracle Application Server

Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know ...
3
votes
1answer
166 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
2
votes
3answers
2k views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
1
vote
1answer
409 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
1
vote
1answer
5k views

How to disable x-oracle-dms-ecid cookie

During a security audit, our client found that we are sending to the client a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
0
votes
1answer
880 views

oracle weblogic vulnerability

I searched for Oracle Web logic vulnerabilities and found this vulnerability: Oracle WebLogic Server Cross-Site Scripting and Manipulation of Data Vulnerabilities (http://secunia.com/community/...
4
votes
1answer
397 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from http://docs.oracle.com/...
-15
votes
1answer
502 views

Random Oracle existence and real world

I am looking at oracle security. What is a random oracle? Does a random oracle exist? How is the random oracle behavior approximated in the real world?
1
vote
1answer
150 views

Oracle database privileges [closed]

I have a 10.2.0.5.0 Oracle Database and a list of users who i need to grant some privileges to (Mainly to generate reports and so on). I used impersonation, which means i created one Oracle user so ...
8
votes
2answers
3k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
-1
votes
2answers
15k views

Want to authenticate oracle login using encrypted password…how to?

We are connecting to Oracle using korn shell scripts, which use sqlplus to connect to Oracle. The Oracle database is on the same Solaris box. Currently, we are storing the Oracle user id and ...
9
votes
4answers
7k views

How to protect against “padding oracle attacks.”

I need to encrypt something on my server and save the result. Since I am not a security expert, I want to implement as much existing code as possible. I found a fully build function on php.net but ...
4
votes
3answers
2k views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
6
votes
2answers
3k views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
3
votes
4answers
2k views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
6
votes
1answer
878 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
1
vote
1answer
420 views

Is Oracle gathering information from my machine when I download Virtualbox or Netbeans?

When we try to download Netbeans or Virtualbox from the Oracle/Sun site, our firewall warns us that some suite called EdgeSuite tries to obtain information from our machines. I don't know what ...