full-disclosure - Re: Oracle 11g/10g Installation Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8f1f7b60711140904r141e70c5l7aeea1873f79c459@mail.gmail.com>
Date: Wed, 14 Nov 2007 12:04:23 -0500
From: "Peter Dawson" <slash.pd@...il.com>
To: "David Litchfield" <davidl@...software.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	dbsec@...elists.org
Subject: Re: Oracle 11g/10g Installation Vulnerability

FYI only..

Onn the same /similar note, David just got cited here  wrt to SQL

http://blogs.zdnet.com/security/?p=663

On Nov 13, 2007 2:27 PM, David Litchfield <davidl@...software.com> wrote:

> Hey all,
> After investigating 11g the other day I came across an interesting issue.
> During the installation of Oracle 11g and 10g all accounts, including the
> SYS and SYSTEM accounts, have their default passwords and only at the end
> of
> the install are the passwords changed. This means that there is a window
> of
> opportunity for an attacker to log into the database server during the
> install process. Depending upon "which" install options you choose
> determines the size of the window. Full details for those that are
> interested can be found here:
> http://www.davidlitchfield.com/blog/archives/00000030.htm - since I
> reported
> this to Oracle on the 3rd of November they've updated their security
> checklist document:
>
> http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_
> db_database_20071108.pdf
> Cheers,
> David Litchfield
>
> --
> E-MAIL DISCLAIMER
>
> The information contained in this email and any subsequent
> correspondence is private, is solely for the intended recipient(s) and
> may contain confidential or privileged information. For those other than
> the intended recipient(s), any disclosure, copying, distribution, or any
> other action taken, or omitted to be taken, in reliance on such
> information is prohibited and may be unlawful. If you are not the
> intended recipient and have received this message in error, please
> inform the sender and delete this mail and any attachments.
>
> The views expressed in this email do not necessarily reflect NGS policy.
> NGS accepts no liability or responsibility for any onward transmission
> or use of emails and attachments having left the NGS domain.
>
> NGS and NGSSoftware are trading names of Next Generation Security
> Software Ltd. Registered office address: 52 Throwley Way, Sutton, SM1
> 4BF with Company Number 04225835 and VAT Number 783096402
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/