Hot answers tagged

22

Whether or not it contains an exploit, specifically, is irrelevant in the broader question of whether an OVA file can be malicious. The answer to the broader question is yes, absolutely. The Open Virtualization Format specification gives you an idea of some of the potential vectors, but the obvious one is that it could map your entire OS disk to the VM and ...


16

Any file can contain an exploit. Whether it works or not, or if it requires a loader, is another story. For example, if there's a buffer overflow vulnerability in the processing of .ova files, then yes, it could contain an exploitable vulnerability. It all depends on whether or not you have a vulnerable application which processes the file that contains ...


14

The padding oracle is a mixture of a protocol flaw and an implementation flaw. Namely, a "padding oracle" leaks some information about secret data through how it reacts to maliciously crafted invalid input. A good protocol will first validate the input data through a MAC before considering decryption and its corollary, padding processing. That's what the "...


11

To protect against padding oracles, you want to make sure that your application does not return a different error when the padding is wrong. The best way to do this is an Encrypt-then-MAC construction, where a Message Authentication Code (MAC) is applied to the ciphertext. If the MAC fails, you don't even need to look at the padding. If the MAC is correct,...


9

Fixed processing time is the most basic and thorough method to defend against timing attacks: to avoid exploitation of the data you leak through timing, well, do not leak. However, it is easier said than done. The recent "Lucky Thirteen" shows that it is possible to detect timing differences with a microsecond accuracy when the target is "close" to the ...


8

Identification and tracking become important but surprisingly difficult. First, tag the accounts in the directory so you can identify them as non-user IDs. Each non-user account needs to be associated with an account owner, someone responsible for securing the system it accesses. Store the owner's identity in the non-user ID's directory entry, so if ...


5

There are three common ways to deal with the variety of databases out there: Many web applications are tied to a specific database backend, rather than being able to use a variety of backends. For example, if someone's using MediaWiki, you know they're using either MySQL or MariaDB. An attacker can attempt to generate an error condition, then look at the ...


5

What is a random oracle? Imagine a monkey living in a black box with a book and a dice. You feed some input into the box. The monkey generates some random and uniform output with his dice, writes it down in his book and returns the output to you. If you feed some input into the box that the monkey has already seen, he looks it up in his book and returns the ...


5

JInitiator is based on Sun (now Oracle) JVM implementation, so it is a safe bet that every single vulnerability which was in Sun/Oracle JVM before 2008 (when the last JInitiator version was produced) but discovered only afterwards applies to JInitiator. Lack of CVE only comes from disinterest on the part of people who fill CVE (there is no glory in pointing ...


5

Depending on your setup between the host and the virtual guest there are a few ways that a worm or virus could propagate. 1) Simple networking. - If you have the networking adapter enabled on the virtual and the host can interact with it, then yes. A piece of malware that was multi-OS could propagate. Alternatively, if the malicious code was written in a ...


4

Virtualization is designed to protect the host operating system (in your case windows) from the guest operating system (Linux). It's unlikely that a virus or malware running on a guest is going to spread directly to the host through the virtualization layer. The malware would have to be specifically designed to target the virtualization layer, and somehow ...


3

Update (June 2015) : Oracle Forms 11g (the latest version) is now certified with Java 7 (or 1.7; the naming convention chops and changes with Java !) and I believe with the latest Java 8 too. I can certainly confirm that an Oracle Forms 11g application works with both of these versions, with no tweaks required on the JRE client side. Oracle Forms 10g (now ...


3

There are two ways to answer this. The first way follows your line of thinking, the other does not. While it's hard to be sure for any specific database, due to slack space (i.e. not shrinking the data file when stuff is deleted), journaling, and other database features, I'd suspect that the following is reasonably sufficient for a system like InnoDB: Do ...


3

You can try this two ways of executing code on Oracle DBMS. The first is with Java code: http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql -- Usage example: -- $ sqlplus "/ as sysdba" -- [...] -- SQL> @raptor_oraexec.sql -- [...] -- SQL> exec javawritefile('/tmp/mytest', '/bin/ls -l > /tmp/aaa'); -- SQL> exec javawritefile('/tmp/mytest', '...


3

You ask for a workaround for "Unspecified vulnerability...allows remote attackers to affect confidentiality via vectors related to JSSE". Since the only information you find in this sentence is that it is somehow related to JSSE you are maybe safe if your application is not using JSSE. Apart from that there were lots of critical fixes in Java and JDK6 is ...


3

In general there's not a huge amount of difference between users created for automation, and users created for actual people. You should still limit the access each user has to only what's required. It's a little bit more ambiguous to think about how to segment the 3rd party services access to a trusted resource. A person normally has just one account, ...


3

Other commentator suggested to use certificates instead of LDAP - But I will not advice at using 2 authentication mechanisms if you can't easily do it. Having one authentication system will make sure there will be less likelihood for poor implementations. For strong passwords use a "UUID-type 4" generator algorithm - this will give you a random String that ...


3

You can check the Nessus log to see what checks it performed, what plugins it used / attempted to use. Steps In the scan settings, make sure Log Scan Details to Server is checked Execute the scan After the scan, check the log file in: /opt/nessus/var/nessus/logs/nessusd.messages


3

Is it necessary to sign or will a modified encrypted string fail to decrypt? In the cryptography world a modified message is called a tampered message. Encryption by itself does not provide protection against tampering, but block ciphers are not used alone. Block ciphers are used in different modes, f.e. ECB, CBC, CTR, GCM, etc. Different modes have ...


3

The short answer is that you cannot rely on encryption to ensure the integrity of a message. See here for example. To demonstrate why that general statement is also true for the specific example of this question, let's see how an attacker can modify an encrypted message. For the sake of simplicity I'm going to assume you're using AES-CBC encryption. Let's ...


3

Yes, any guest OS such as contained in OVA files can carry malicious code; even mere data files of a certain complexity can effectively launch exploits. Therefore, the flavor of Whonix you may be looking for is the one that runs under the Qubes OS hypervisor, as every aspect of Qubes is designed to prevent privilege escalation attacks from within guest VMs. ...


3

According to Oracle JRE and JDK Cryptographic Roadmap Symantec Root CAs will be removed in April 2019 release: Date: 2019-04-16 Releases: 12, 11, 8, 7 Action: Distrust TLS server certificates anchored by Symantec Root CAs.


2

http://download.oracle.com/docs/cd/A91202_01/901_doc/network.901/a90151/security.htm


2

It would appear that PL/SQL source text wrapping is not useful to eliminate the technical means to read PL/SQL code, but rather to accomplish one or more of the following goals. To discourage novice software developers from relying on implementations rather than interfaces for packages and types. So source text wrapping could tend to avoid backward ...


2

You can subscribe to Oracle's security advisory mailing list by following the instructions at http://www.oracle.com/technetwork/topics/security/securityemail-090378.html. You should also read http://www.oracle.com/technetwork/topics/security/alerts-086861.html for more information. In particular, the section relating to third party bulletins.


2

Look into Secure External Password Store section here. Basically, you setup a client-side Oracle wallet, save user, password, and TNS alias. Then your script will connect to the database as: sqlplus /@tns_alias @my_script.sql I hope it helps, Ed


2

BASE64 is as bad as plaintext and does not offer any security. Your DBAs are also wrong stating that hashing the password before it's sent will solve the issue as you can just perform a pass-the-hash like attack (I'm not even sure Oracle supports something like that). Both approaches would allow for people on the network to gain access to the database (it ...


2

The Padding Oracle Attack is a side channel attack that can be used to decrypt ECB or CBC symmetric ciphers. This attack works leakaging information about the padding during decryption of the ciphertext. To prevent this you can add authentication to the ciphertext, for instance using HMAC. The most used technique is Encrypt-then-MAC. In PHP, you can use the ...


2

Disable by adding the following lines in your Httpd.conf: Header unset X-ORACLE-DMS-ECID Header always unset X-ORACLE-DMS-ECID


2

It is a common concept to create specific Database-Users for each application. These users should have the minimum privileges needed to do their job. Lets apply this to your example: ApplicationA uses DataBaseUserA which has the privileges to Read/Insert/Update/Delete TableA in SchemaA. ApplicationB uses DataBaseUserB which has the privileges to Read ...


Only top voted, non community-wiki answers of a minimum length are eligible