New hacker skills may cause Oracle Leakage

Welcome to the Oracle community forum and interact with 2 million technical staff. A security researcher warned that a new attack technique increases the risk of common vulnerabilities in Oracle Database software. In the past, it was generally believed that attackers needed advanced database permissions to exploit the so-called PLSQL Injection Vulnerability. However, NGSSoftware Information Security

Welcome to the Oracle community forum and interact with 2 million technical staff> A security researcher warned that a new attack technique increases the risk of common vulnerabilities in Oracle Database software. In the past, it was generally believed that attackers needed advanced database permissions to exploit the so-called pl SQL injection vulnerability. However, NGS Software Information Security

Welcome to the Oracle community forum and interact with 2 million technical staff> enter

A security researcher warned that a new attack technique increases the risk of common vulnerabilities in Oracle Database software.

In the past, it was generally believed that attackers needed advanced database permissions to exploit the so-called pl SQL injection vulnerability. But David Litchfield, an information security expert of NGS Software, said at the Black Hat DC Conference on Thursday that a new attack technique has changed this fact.

"Attackers can use this technique to fully control the database server as long as they have the minimum permissions," Litchfield said during access acceptance: "You can use it to intrude into many vulnerabilities that you previously considered unimportant."

Litchfied, a long-term study of Oracle software, published a paper at the Black Hat DC conference last week to discuss in detail this kind of technique called cursor injection, an attack code instance using this technique has appeared, said Litchfield.

Oracle also issued a statement stating that the company has noticed this new attack.

"The NGS Software's 'cursor Injection 'paper illustrates a technique that may help attackers exploit SQL Injection vulnerability," the database developer said. Oracle strongly requires customers to install patches provided by it to fix known vulnerabilities.

In the past, the pl SQL injection vulnerability usually required the attacker to have the create procedure permission for the database. Most users do not have this permission. Using the pointer injection technique, anyone who connects to the database can exploit this vulnerability, Litchfield said.

"It injects pre-compiled pointers into vulnerable pl SQL objects for attack purposes," Litchfield pointed out in the paper. "The purpose of this study is to explain, all SQL injection vulnerabilities can be fully exploited without any system permissions (except for the 'establish session' permission."

In the future, Oracle should no longer regard permission requirements as the reason for the delay in fixing pl SQL vulnerabilities, Litchfield said. Oracle customers may be in danger of delayed patch installation, he said. "The excuses for not patching this special vulnerability no longer exist," Litchfield said.

Although Litchfield believes that his findings increase the severity of many Oracle vulnerabilities, another famous database security researcher does not agree with him.

"The example mentioned by Davids only applies to the situation where a user uses special permissions and dynamic statements to create a vulnerable data packet in a high-permission account, alexander Kornbrust, managing German Red Database Security, pointed out: "I did not find this situation when reviewing pl SQL source code, and I also checked pl SQL source code from many users and companies."

Oracle has been in constant contact with security researchers for several years. However, the company has made changes and is willing to face problems in the product security process honestly. On July 6, January, Oracle began to notify the quarterly patch release in advance. In June last October, the company added the severity level to the report for the first time.