There are several security holes here. You can search CERT (www.cert.org)
for the details. The only port/protocol I've seen anyone allow is for ssh.
The dba could then shell in and manage what they need.
- Paul
- Original Message -----
To: "Multiple recipients of list ORACLE-L" <ORACLE-L_at_fatcity.com>
Sent: Monday, April 15, 2002 11:53 PM
> Hi,
>
> We have a network/web hosting shop, and one of our customers is asking for
a
> firewall to be opened for DBA access over the internet. They want two
> non-Oracle specific ports opened so that their Oracle Databases can be
> administrated via the internet.
>
> Has anyone heard of any vulnerabilities associated with this? Or is there
> anything that I should be aware of in terms of security? Or should I be
> asking them any questions?
>
> Thanks
>
> Sujatha
> --
> Please see the official ORACLE-L FAQ: http://www.orafaq.com
> --
> Author: Sujatha Madan
> INET: Sujatha.Madan_at_cmc.cwo.net.au
>
> Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
> San Diego, California -- Public Internet access / Mailing Lists
> --------------------------------------------------------------------
> To REMOVE yourself from this mailing list, send an E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
> the message BODY, include a line containing: UNSUB ORACLE-L
> (or the name of mailing list you want to be removed from). You may
> also send the HELP command for other information (like subscribing).
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Paul Troiano
INET: paultroiano_at_earthlink.net
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
San Diego, California -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the HELP command for other information (like subscribing).
Received on Tue Apr 16 2002 - 16:08:23 CDT
