OraFAQ Forum: Networking and Gateways » Security risk to Listener service

Home » RDBMS Server » Networking and Gateways » Security risk to Listener service

Show: Today's Messages :: Polls :: Message Navigator
E-mail to friend

Security risk to Listener service [message #252390]

Wed, 18 July 2007 14:27

danimars
Messages: 10
Registered: October 2005
Location: London

Junior Member

hi.

i wanted to know if listener service is not password protected and running on default port 1521 then is it still vulnerable in Oracle 8i if operating system authentication is being used. I think it should be still vulnerable coz I have read papers and I havent read anything anywhere that says operating system authentication resolves the vulnerability issues of the listener service. Please help

Report message to a moderator

Re: Security risk to Listener service [message #252393 is a reply to message #252390]

Wed, 18 July 2007 14:33

BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal

Senior Member

HUH?
OS Authenication means the user is logged directly onto the the DB server system.
If this is the case then SQL*Net is NOT used to connect the local user to the DB.
The password involving the listener only controls the stopping the listener & NOT logging into the DB itself.

Report message to a moderator

Re: Security risk to Listener service [message #252403 is a reply to message #252393]

Wed, 18 July 2007 14:45

danimars
Messages: 10
Registered: October 2005
Location: London

Junior Member

Thanks for the quick reply. I am a little confused about this. If SQL*NET will not be used then how will the client using oracle e-business suite establish connections to the database. because as far as I have read the Listener service provides basic connectivity for clients, application servers, and other databases to an Oracle database as it manages the network traffic. that is in the scenario of OS authentication being used.

Report message to a moderator

Re: Security risk to Listener service [message #252409 is a reply to message #252390]

Wed, 18 July 2007 14:59

BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal

Senior Member

You are the one who keep including OS Authentication into the discussion.
Refer to me previous reply WRT how & when OS Authentication is used.
The Oracle Listener ONLY comes into play when a remote client wants to establish a connection to the DB.
After the Listener establishes the connection between the client & the database, the listener is NO longer involved with that client (or this DB session).

I suggest you Read Then Fine Concepts Manual found at http://tahiti.oracle.com

WRT, e-business suite, AFAIK this a 3 tier architecture & whole bunch of different rules apply.

Report message to a moderator

Previous Topic:	Help! ORA-12560 TNS protocol adapter error (split)
Next Topic:	ora - 01002 Fetch out of sequence

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Fri Apr 19 09:28:55 CDT 2024