An easy to ignore Oracle security issue

Source: Internet
Author: User
Tags modify oracle database
oracle| Safety | Problem database security problem has always been one of the focus of attention, we know that a business or organization of the database if the hacker attacks, and these databases and the preservation of very important data, such as banks, communications and other databases, the consequences will be disastrous. Oracle databases use a variety of tools to ensure database security, such as passwords, roles, permissions, and so on. As Oracle database administrators know, after the typical database system installation, the general SYS and system and internal three users with the default password, after the successful database installation, the system administrator's first task is to modify the password of these users to ensure the security of the database. However, many administrators tend to overlook one of these security issues, and we'll discuss this in detail below. Oracle database systems After a typical installation, in addition to creating a few of the users described earlier, a user named Dbsnmp is automatically created who is responsible for running the intelligent agent for the Oracle System (Intelligent Agent), and the user's default password is also " Dbsnmp ". If you forget to modify the user's password, anyone can access the database system through that user. Now let's take a look at what permissions and roles the user has and then analyze the user's potential loss to the database system. Start the Sql/plus program and use the user login to enter: Sql> select * from Session_privs; CREATE sessionalter sessionunlimited tablespacecreate tablecreate clustercreate synonymcreate public SYNONYMCREATE Viewcreate sequencecreate DATABASE linkcreate procedurecreate triggeranalyze anycreate typecreate OPERATORCREATE Indextype can see that the user is not a sys or system Admin user, however, it has two system-level permissions: Unlimited tablespace and create public synonym. See these two permissions you should immediately think that these are security risks, especially unlimited tablespace, it is one of the attack points to destroy the database system. If at this time you still think, even if someone uses this not to change the password to log in to the database can not cause any loss, I have to remind you: the user has unlimited TABLESPAce's system permissions, it can write a small script, and then maliciously fill the system with garbage data, so that the database system will not run, and directly lead to the eventual paralysis. At present, many database systems require 7x24 work, if there is a system with garbage data filled with the situation, then, such as database system recovery, I am afraid that irreparable damage has been caused. In order to ensure the absolute security of the Oracle database system, it is strongly recommended that the database administrator modify the user's default password and not leave the "door" for malicious people.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.