Auditing an Oracle database for security issues is very important. provides all of the information and tools that you will need Click here for details of Limited's detailed Oracle database security audit service Click here for details of Limited's Oracle Security Training Courses
There are 54 visitors online    
Cookie Policy:We only use essential cookies on small sections of this website. For details see here.

Pete Finnigan's Oracle security weblog

Home » Archives » January 2006 » Imperva discovers a critical access control bypass in login bug

[Previous entry: "January 2006 Critical Patch Update Oracle security patch is released"] [Next entry: "Red Database Security has released 5 Oracle security bug advisories"]

Imperva discovers a critical access control bypass in login bug

January 17th, 2006 by Pete

Imperva has released an advisory for a bug that they have found in the TNS protocol that allows a user with no more than CREATE SESSION privileges to execute any SQL statement in the context of the SYS user. Imperva's advisory is titled "Security Advisory: Oracle DBMS Critical Access Control Bypass in Login Bug". This is a very interesting advisory that details how the O3Login process can be used to execute any SQL command. During the login process the first request (message code 0x73) contains only the username, the second request (message code 0x76) contains the username and an encrypted password. It also contains name-value pairs intended to set up session attributes. One of these is AUTH_ALTER_SESSION intended to set up language and locale. It can however be used to create a user and create DBA privileges for that account.

This is a very interesting bug described in this alert.

January 2006

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

Weblog Home
Weblog Archives

Oracle Security Tools page
Oracle security papers
Oracle Security alerts

Web Development
SQL Server Security

Atom 0.3 FEED
Powered by gm-rss 2.0.0

Valid XHTML 1.0!