Questions tagged [oracle]

an American computer technology company based in California. Oracle specialize in computer hardware and enterprise software products including it's own brand RDBMS, along with MySQL and Java as a result of purchasing Sun Microsystems.

Filter by
Sorted by
Tagged with
21
votes
3answers
384 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
14
votes
1answer
2k views

Is there a list of default, standard or third-party “users” for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of schemas/...
11
votes
4answers
9k views

How to protect against “padding oracle attacks.”

I need to encrypt something on my server and save the result. Since I am not a security expert, I want to implement as much existing code as possible. I found a fully build function on php.net but ...
10
votes
2answers
4k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
8
votes
3answers
4k views

Can .ova file contain an exploit?

Is it possible to prepare an .ova file for Oracle Virtualbox that will access NAT network when is set to use Whonix? There are preconfigured virtual machines like Windows to use in Whonix, but are ...
8
votes
3answers
2k views

Are encrypted Cookies vulnerable to Padding Oracle Attacks

I'm currently helping write a fast compiled web framework in the crystal language and am trying to find a way to speed up sessions using encrypted cookies. We're currently taking a json string and ...
8
votes
2answers
3k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
7
votes
2answers
3k views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
7
votes
1answer
722 views

What evaluation criteria would you use for an Oracle scanning tool?

What evaluation criteria would you use to select the right Oracle scanning tool? Context: To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
6
votes
2answers
135 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...
6
votes
1answer
893 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
5
votes
2answers
496 views

Oracle Internet Directory (OID) hardening

What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory? note: OID is compatible with LDAP version 3.
5
votes
2answers
2k views

Oracle ExaData Security best practice

Does anybody have experience with Oracle ExaData Security? Client wants to move all of his Oracle DB to central Oracle ExaData server. So on same machine will be hosted DBs of different vendors and ...
4
votes
4answers
2k views

How Likely Is It For A Virus To Spread From A Linux VM To The Windows Host

I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it ...
4
votes
3answers
2k views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
4
votes
1answer
99 views

Is it possible to take over a Windows server through Oracle?

I have a Windows Server 2008 R2 with an Oracle database running on it. Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can ...
4
votes
2answers
179 views

Do I have to change my database user password in this situation?

Ok I know this is a stupid question but our one and only DBA get into a mess with our manager and rage quit today. As a small company, I (IT support guy who knows nothing about DB) was told to change ...
4
votes
1answer
461 views

What is the best practice for giving Oracle DB credentials to a Java Application?

I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications? I came ...
4
votes
1answer
674 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar [...
4
votes
1answer
4k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
4
votes
1answer
399 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from http://docs.oracle.com/...
3
votes
3answers
115 views

Are encrypted databases secure against all attacks?

If I use a database encryption package for oracle like dbms_crypto, would this be vulnerable to any attacks? I know that it uses algorithms like 3DES, AES, etc. These are all thigns that you can use ...
3
votes
2answers
133 views

Is there a risk of using AEAD encryption algorithms when the key is generated from a password?

I need to encrypt something on a smartphone. The data is relatively small and would be stored encrypted on the phone. I was thinking AES-GCM with a key generated by a password (chosen by the app's ...
3
votes
1answer
4k views

How can I securely delete items in a database?

I know that to securely delete files on a system I have to apply some kind of secure deletion (overwritting empty clusters, for example). But when I want to delete some information on a database (...
3
votes
1answer
332 views

Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?

We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
3
votes
1answer
166 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
3
votes
4answers
2k views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
2
votes
3answers
2k views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
2
votes
1answer
61 views

is there a workaround for CVE-2015-2625?

we are not able to upgrade jdk 6 to jdk1.8u51 where this issue (CVE-2015-2625) is fixed. is there a workaround one can have until we migrate to jdk1.8?
2
votes
0answers
99 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
2
votes
1answer
7k views

Using TLSv1.2 on Weblogic server for outgoing transactions with IBM JDK [closed]

I am trying to use TLSv1.2 for all communications going out from my Weblogic application server(acting as SSL client) but couldn't use it. System details: Weblogic 12c IBM JRE7 SR9 Things I have ...
1
vote
1answer
1k views

How do I know if a Nessus Scan against a Oracle instance has been sucessful?

I have a Nessus Policy with all the Oracle plugins activated and the rest of the plugins disabled. I ran the scan against a fresh installation but I get nothing but the Oracle TNS Listener Remote ...
1
vote
1answer
6k views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
2k views

OpenSSL oracle padding vulnerability (CVE-2016-2107)

Hi We have a Windows 2008R2 SP1 server system running Oacle with OpenSSL. Upon doing a security scan we have found out that we are getting: OpenSSL oracle padding vulnerability(CVE-2016-2107) ...
1
vote
1answer
300 views

Executing XSS on .jsp page by escaping string and with raw bytecode?

Assume that a java (.jsp) page takes a from input as a string, the server does nothing to sanitize it, and then echoes it back to the user. How would an attacker escape the string to execute ...
1
vote
1answer
933 views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
1
vote
1answer
792 views

Difference between Oracle Label Security and Oracle Virtual Private Database?

I am working on a class project, and our lecturer ask a question with this title, I searched in net but I could not find a clear answer. if there is difference what are they? thanks
1
vote
2answers
259 views

Stop POODLE vulnerability in Oracle Application Server

Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know ...
1
vote
1answer
5k views

How to disable x-oracle-dms-ecid cookie

During a security audit, our client found that we are sending to the client a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
1
vote
1answer
583 views

Understanding Oracle 11g password hashing algorithms

I'm trying to understand the Oracle 11g password hashing algorithm, I found this link explaining how it is done, however, I have some confusion on how they say it's done. According to that link it ...
1
vote
2answers
155 views

Why Oracle says following deserialization vulnerabilities are related to HTTP protocol?

According to Oracle website, following deserialization vulnerabilities are related to HTTP protocol. CVE-2015-7501, CVE-2016-5535, CVE-2016-3586, CVE-2016-3510, etc. But I do not understand why ...
1
vote
1answer
423 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
1
vote
1answer
430 views

Is Oracle gathering information from my machine when I download Virtualbox or Netbeans?

When we try to download Netbeans or Virtualbox from the Oracle/Sun site, our firewall warns us that some suite called EdgeSuite tries to obtain information from our machines. I don't know what ...
1
vote
1answer
668 views

OpenSSO and Basic Auth together

Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
1
vote
0answers
66 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
1
vote
0answers
53 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
1
vote
1answer
281 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
1
vote
0answers
88 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...
1
vote
0answers
158 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
1
vote
0answers
997 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...