[Full-disclosure] Two papers on Oracle 11g Security

-DC2010.pdf Cheers, David Litchfield -- E-MAIL DISCLAIMER The information contained in this email and any subsequent correspondence is private, is solely for the intended recipient(s) and may contain confidential or privileged information. For those other than the intended recipient(s), any

[Full-disclosure] Oracle 11g (11.1.0.6) Password Policy and Compliance

e in their April 2009 Critical Patch Update and maps to the currently unspecified vulnerability at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0988 Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ -- E-MAIL DISCLAIMER The information contained in this email an

[Full-disclosure] Oracle PL/SQL Injection Flaw in REPCAT_RPC.VALIDATE_REMOTE_RC

(http://www.databasesecurity.com/dbsec/cursor-injection.pdf) which was written 3 days after. Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ -- E-MAIL DISCLAIMER The information contained in this email and any subsequent correspondence is private, is solely for the intended

[Full-disclosure] Bypassing DBMS_ASSERT in certain situations

DBMS_ASSERT can be used to prevent PL/SQL injection. In certain cases it can be bypassed. This is documented in a paper I wrote in July 2008 but am only publishing now: http://www.databasesecurity.com/oracle/Bypassing-DBMS_ASSERT.pdf Cheers, David Litchfield NGSSoftware Ltd http

[Full-disclosure] Trigger Abuse of MDSYS.SDO_TOPO_DROP_FTBL in Oracle 10g R1 and R2

NGSSoftware Insight Security Research Advisory Name: Trigger abuse of MDSYS.SDO_TOPO_DROP_FTBL Systems Affected: Oracle 10g R1 and R2 (10.1.0.5 and 10.2.0.2) Severity: High Vendor URL: http://www.oracle.com/ Author: David Litchfield [ dav...@ngssoftware.com ] Reported: 23rd July 2008 Date of

[Full-disclosure] New tool and paper for Oracle forensics...

e subject of the paper "Oracle Forensics Part 7: Using the Oracle System Change Number in Forensic Examinations". Both the tool (which compiles on Linux, Mac OS X and Windows) and the paper are available from http://www.databasesecurity.com/. Cheers, David Litchfield NGSSoftware Ltd http://ww

Re: [Full-disclosure] Deep Blind SQL Injection Whitepaper

Hi Ferruh, > This is a short whitepaper about a new way to exploit Blind SQL > Injections. I just had a read of your paper. You open with: "If the injection point is completely blind then the only way to extract data is using time based attacks like WAITFOR DELAY, BENCHMARK etc." This is not t

Re: [Full-disclosure] Pwnie Awards 2008

Hey Alexandr, I see I'm invited to award Brett his pwnie for his SQL flaw if he wins. I'd be more than happy to - after all one bug over 3 years means someone did a really good job ;) Cheers, David -- E-MAIL DISCLAIMER The information contained in this email and any subsequent correspondence is p

[Full-disclosure] Lateral SQL Injection Revisited - No Special Privs Required

At the end of April 2008 I published a paper about a new class of flaw in Oracle entitled "Lateral SQL Injection". The paper can be found here: http://www.databasesecurity.com/dbsec/lateral-sql-injection.pdf Essentially the paper details a way in which the attacker can manipulate the environment

[Full-disclosure] Oracle Application Server PLSQL injection flaw

NGSSoftware Insight Security Research Advisory Name: PLSQL Injection in Oracle Application Server Systems Affected: Oracle Application Server 9.0.4.3, 10.1.2.2, 10.1.4.1 Severity: Critical Vendor URL: http://www.oracle.com/ Author: David Litchfield [ [EMAIL PROTECTED] ] Reported: 9th October 2007

[Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

Hey all, I've just released some research that demonstrates a new class of vulnerability in Oracle and how it can be exploited by an attacker. You can grab the paper from here: http://www.databasesecurity.com/dbsec/lateral-sql-injection.pdf Cheers, David Litchfield NGSSoftware Ltd

[Full-disclosure] Oracle 11g/10g Installation Vulnerability

s/0030.htm - since I reported this to Oracle on the 3rd of November they've updated their security checklist document: http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_ db_database_20071108.pdf Cheers, David Litchfield -- E-MAIL DISCLAIMER The information co

[Full-disclosure] SQL Injection Flaw in Oracle Workspace Manager

(resend with title...) NGSSoftware Insight Security Research Advisory Name: SQL Injection Flaw in Oracle Workspace Manager Systems Affected: Oracle 10g release 1 and 2, Oracle 9i Severity: High Vendor URL: http://www.oracle.com/ Author: David Litchfield [ [EMAIL PROTECTED] ] Reported: 22nd

[Full-disclosure] Another Oracle Forensics Paper...

Hey all, For anyone that's interested I've just posted another paper entitled "Oracle Forensics Part 6: Examining Undo Segments, Flashback and the Oracle Recycle Bin". You can get this and other papers on Oracle forensics from http://www.databasesecurity.com/oracle-forensi

[Full-disclosure] New Oracle Forensics Paper

of the ideas I discussed at Blackhat. Cheers, David Litchfield -- E-MAIL DISCLAIMER The information contained in this email and any subsequent correspondence is private, is solely for the intended recipient(s) and may contain confidential or privileged information. For those other than the intended re

[Full-disclosure] Oracle Forensics Part 4: Live Response

Hey all, For anyone that wants a copy, I've just posted the fourth paper in the Oracle Forensics series I'm writing to http://www.databasesecurity.com/. This paper covers what an incident responder should do during a Live Response on a compromised Oracle server. Cheers, David Litchf

[Full-disclosure] Analysis of the Oracle April 2007 Critical Patch Update

Hey all, I've just posted an analysis of the Oracle April 2007 Critical Patch Update to http://www.ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf (URL may line wrap) Cheers, David Litchfield -- E-MAIL DISCLAIMER The information contained in this email and any subse

[Full-disclosure] Three New Papers on Oracle Forensics

gainst the Authentication Mechanism You can grab them here: http://www.databasesecurity.com/ Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ -- E-MAIL DISCLAIMER The information contained in this email and any subsequent correspondence is private, is solely for the intended recipient(

[Full-disclosure] Cursor Injection - A New Method for Exploiting PL/SQL Injection and Potential Defences

the paper from http://www.databasesecurity.com/ - it's called "Cursor Injection - A New Method for Exploiting PL/SQL Injection and Potential Defences". Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ +44(0)208 401 0070 -- E-MAIL DISCLAIMER The information co

[Full-disclosure] Oracle - Indirect Privilege Escalation and Defeating Virtual Private Databases

Hey all, For anyone that's interested I've just put out two papers (chapters really); one on Indirect Privilege Escalation in Oracle and the other on Defeating Virtual Private Databases in Oracle. You can grab them here. http://www.databasesecurity.com/dbsec/ohh-indirect-privilege-escalation.pdf

[Full-disclosure] Cursor snarfing - a new class of vulnerability and attack in Oracle

Hey all, I've just written a paper detailing a fairly common PL/SQL programming error related to cursors that leads to a new class of vulnerability in Oracle. You can get a copy of the paper from http://www.databasesecurity.com/ . Cheers, David Litchfield NGSSoftware Ltd +44(0) 208 401 0070

[Full-disclosure] Analysis of the Oracle October 2006 Critical Patch Update

rity.com/oracle/OracleOct2006-CPU-Analysis.pdf, Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ +44(0) 208 401 0070 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted a

[Full-disclosure] ASLR now built into Vista

has just got a lot harder. I've not done a thorough analysis yet but, all going well, this is a fantastic way for Microsoft to go and builds on the work done with NX/DEP and stack cookies/canaries. Cheers, David Litchfield [1] http://msdn.microsoft.com/windowsvista/downloads/products/getth

[Full-disclosure] Re: How secure is software X?

ontent/Wiki.jsp?page=Welcome) Also there's a project of US DHS/NIST and probably others called SAMATE Software Assurance Metrics and Tool Evaluation http://samate.nist.gov/index.php/Main_Page which might be of interest. Adam On Fri, May 12, 2006 at 02:59:17AM +0100, David Litchfield wrote: |

Re: [Full-disclosure] How secure is software X?

s that it is a standard. A such efforts should be entirely reproducible. Have 3 or more people follow that standard and compare results at the end. If there's a discrepancy someone's not following the standard. The other aspect of course that it's trivial to write and verify to

[Full-disclosure] How secure is software X?

that are attempting to achieve the same thing. If anyone is currently working on this stuff or would like to get involved in thrashing out some ideas then please mail me - I'd love to hear from you. Cheers, David Litchfield http://www.databasesecurity.com/ http://www.ngssoftware.com/ ___

Re: [Full-disclosure] MS06-019 - How long before this develops into aself propagating email worm

experience is anything to go by the only missing ingredient is proof of concept code released by a well meaning security researcher! Cheers, David Litchfield ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Oracle - the last word

Oracle to fix them but, from now on, I'll leave the proselytizing to others. Oracle have moved sufficiently forward enough, and with enough momentum (now), that I believe they've passed the point of no return and can do nothing but eventually end up where we all want them to be. Cheers,

[Full-disclosure] Oracle, where are the patches???

y 2006 critical patch update was re-issued seven times, the October 2005 CPU three times and the July 2005 CPU was re-issued nine times. The story is the same for earlier CPUs. Mary, Mary, quite contrary to what you'd have us believe about Oracle's security track record, it's

[Full-disclosure] Recent Oracle exploit is _actually_ an 0day with no patch

this package will help mitigate the risk. Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ +44(0)208 401 0070 ** Oracle's response to 13/04/2004 report ** Thanks David. This will also be investigated. This will be reference number 2004S141E. Andrew Oracle Securit

[Full-disclosure] Multiple critical and high risk issues in Oracle's database server

NGSSoftware has discovered multiple critical and high risk vulnerabilities in Oracle's Database Server. Versions affected include Oracle Database 10g Release 2, versions 10.2.0.1, 10.2.0.2 Oracle Database 10g Release 1, versions 10.1.0.4, 10.1.0.5 Oracle9i Database Release 2, versions 9.2.0.6, 9

[Full-disclosure] Advisory - -Thu Mar 16 14:27:08 EST 2006- - Buffer Overflow in Microsoft Excel

Advisory - -Thu Mar 16 14:27:08 EST 2006- - Buffer Overflow in Microsoft Excel 1. BACKGROUND There has had been no background. 2. WORKAROUND This vulnerability has no workarounds. 3. CVE INFORM

[Full-disclosure] More on the workaround for the unpatched Oracle PLSQL Gateway flaw

denied.htm?attempted-attack # Thanks, Mike Pomraning! For those that haven't been able to adopt the workaround because it would break their specific application, then the modified workaround should work in your situation. Cheers, David Litchfield ___

[Full-disclosure] The History of the Oracle PLSQL Gateway Flaw

ly if the web users request starts with "banking" and reject everything else. This is an entirely much more secure and robust solution than the "black list" approach. Will we ever be given this as a solution? Who knows. As it seems providing a decent security solution is beyond

[Full-disclosure] Workaround for unpatched Oracle PLSQL Gateway flaw

attack I don't think leaving their customers vulnerable for another 3 months (or perhaps even longer) until the next CPU is reasonable especially when this bug is so easy to fix and easy to workaround. Again, I urge all Oracle customers to get on the 'phone to Oracle and demand the re

[Full-disclosure] AIX Heap Overflow paper

p.pdf Cheers, David Litchfield ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Snagging Security Tokens to Elevate Privileges

I've just put up a Database Security Brief; the first of many to come. http://www.databasesecurity.com/dbsec-briefs.htm It's called a brief because there's enough meat to make it interesting but not enough to make it a paper ;) This brief, Snagging Security Tokens to Elevate Privileges, details

Re: [Full-disclosure] Framework for the aid of exploiting SQL injection

Hi Roman, Is there any recommended tool which helps to get databases tables, entries, structure, etc, given a particular SQL injection bug in one application? I mean, it should *automatically* try different sentences to figure out the names of the columns and in general, other useful info from th

Re: [Full-disclosure] Database servers on XP and the curious flaw

Hi Eliah, David Litchfield wrote: Hey all, I've just put up a paper on a curious flaw that appears when running a My intent is not to MS-bash here, but perhaps Microsoft is to blame for not educating people about this issue. (If they had, your paper would be superfluous.) Usual

[Full-disclosure] Database servers on XP and the curious flaw

the Unintended Consequences of Simple File Sharing". It doubles-up as my entry for the "Longest Title" award. Cheers, David Litchfield http://www.databasesecurity.com/ http://www.ngssoftware.com/ ___ Full-Disclosure - We believe in it. Cha

Re: [Full-disclosure] Not the real n3td3v

Will the real n3td3v please stand up, please stand up? ... couldn't resist... sorry David ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Three years and ten months without a patch

already done so. Cheers, David Litchfield http://www.databasesecurity.com/ http://www.ngssoftware.com/ More commentary on this available here http://www.databasesecurity.com/oracle-commentary.htm ___ Full-Disclosure - We believe in it. Charter: http://li

[Full-disclosure] Re: [AppSecInc Advisory MYSQL05-V0002] Buffer Overflow in MySQL User Defined Functions

Buffer Overflow in MySQL User Defined Functions Risk level: LOW Credits: This vulnerability was discovered and researched by Reid Borsuk of Application Security Inc. How can this even be marked as low risk? If you're loading a library into mysql's address space then you're already executing "ar