lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070418080109.5799.qmail@securityfocus.com>
Date: 18 Apr 2007 08:01:09 -0000
From: ak@...-database-security.com
To: bugtraq@...urityfocus.com
Subject: Advisory: Bypass Oracle Logon Trigger

Name 	            Bypass Oracle Logon Trigger (7826485) [DB05]
Systems Affected 	Oracle 8-10g Rel. 2
Severity 	        High Risk
Category 	        Bypass Security Feature Database Logon Trigger
Vendor URL 	        http://www.oracle.com/
Author 	            Alexander Kornbrust (ak at red-database-security.com)	 
Advisory 	        17 April 2007 (V 1.00)


Details
#######
It is possible to bypass the Oracle database logon trigger. This can cause severe security problems.

Oracle database logon trigger are often used to restrict user access (e.g. based on time or ip addresses) and/or to do audit entries into (custom) tables. This can be bypassed on unpatched systems.

This advisory is available at
<http://www.red-database-security.com/advisory/bypass_oracle_logon_trigger.html>

Patch Information
#################
Apply the patches for Oracle CPU April 2007.


History
#######
07-jun-2006 Oracle secalert was informed
08-jun-2006 Bug confirmed
17-apr-2007 Oracle published CPU April 2007 [DB05]
17-apr-2007 Advisory published


Additional Information
######################
An analysis of the Oracle CPU April 2007 is available here 
<http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html>

This document will be updated during the next few days and weeks with the latest information.


(c) 2007 by Red-Database-Security GmbH
--
http://www.red-database-security.com

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ