full-disclosure - Advisory: Bypass Oracle Logon Trigger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <0DA3146E-B74E-4A1D-8502-776DD5203623@red-database-security.com>
Date: Wed, 18 Apr 2007 12:26:07 +0200
From: Alexander Kornbrust <ak@...-database-security.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Advisory: Bypass Oracle Logon Trigger

Name 	            Bypass Oracle Logon Trigger (7826485) [DB05]
Systems Affected 	Oracle 8-10g Rel. 2
Severity 	               High Risk
Category 	        Bypass Security Feature Database Logon Trigger
Vendor URL 	        http://www.oracle.com/
Author 	                Alexander Kornbrust (ak at red-database- 
security.com)	
Advisory 	        17 April 2007 (V 1.00)

Details
#######
It is possible to bypass the Oracle database logon trigger. This can  
cause
severe security problems.

Oracle database logon trigger are often used to restrict user access  
(e.g.
based on time or ip addresses) and/or to do audit entries into  
(custom) tables.
This can be bypassed on unpatched systems.

This advisory is available at
<http://www.red-database-security.com/advisory/ 
bypass_oracle_logon_trigger.html>

Patch Information
#################
Apply the patches for Oracle CPU April 2007.

History
#######
07-jun-2006 Oracle secalert was informed
08-jun-2006 Bug confirmed
17-apr-2007 Oracle published CPU April 2007 [DB05]
17-apr-2007 Advisory published

Additional Information
######################
An analysis of the Oracle CPU April 2007 is available here
<http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html>

This document will be updated during the next few days and weeks with  
the
latest information.

(c) 2007 by Red-Database-Security GmbH
--
http://www.red-database-security.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/