Call: +44 (0)1904 557620 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Hacking Oracle, but not in English"] [Next entry: "11i Security papers available"]

More on Oracle hacking techniques



I posted about the Blackhat DC conference that is coming up soon a few days ago in a post titled "Oracle 0-day exploit to be released - Blackhat Washington DC database security presentations" and talked about David Litchfields presentation and surmised what it may be about. Well David will talk about a new Oracle attack vector that involves http://www.databasesecurity.com/dbsec/cursor-snarfing.pdf - (broken link) dangling cursors and will show how a user with only CREATE SESSION privileges can execute any SQL, PL/SQL or DDL in the database. This is quite a cool attack technique.