Re: Resend : Question about EXTPROC and vulnerability

From: Pete Finnigan <oracle_list_at_peterfinnigan.demon.co.uk>
Date: Thu, 31 Jul 2003 01:39:24 -0800
Message-ID: <F001.005C7F44.20030731013924@fatcity.com>

Hi

Or run the extproc as another low privilege user such as "nobody" on Unix. Then the hacker would not be able to run oracle owned libraries as "oracle" and if he did the classic of creating a library using libc and the system() call anything executed would be as nobody and not the owner of the oracle software.

kind regards

Pete
--

Pete Finnigan
email:pete_at_petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists Book:Oracle security step-by-step Guide - see http://store.sans.org for details.

--

Please see the official ORACLE-L FAQ: http://www.orafaq.net
--

Author: Pete Finnigan
  INET: oracle_list_at_peterfinnigan.demon.co.uk

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). Received on Thu Jul 31 2003 - 04:39:24 CDT