Re: Core files of Oracle and Security

From: DA Morgan <damorgan_at_psoug.org>
Date: Wed, 15 Aug 2007 08:36:25 -0700
Message-ID: <1187192183.746575@bubbleator.drizzle.com>

PALDEAL wrote:

> On Aug 14, 8:58 pm, DA Morgan <damor..._at_psoug.org> wrote:

>> PALDEAL wrote:

>>> Hello everyone,
>>> Has anyone delt with Oracle core files and the information in the core
>>> files. I understand that the information is different based when the
>>> core was dumped. From security presepctive, is there a chance that it
>>> could contain lot of data stored in SGA or any data for that matter?
>>> How  easy is it to retreive the data out of the core file? What are
>>> the security risks sending this core file via internet.
>>> Thanks
>>> og

>> Giving anyone physical access to an Oracle server is a security risk.
>> Whether they can get to the core dump files (there shouldn't be any)
>> or whether they get to the control files, or the log files, it really
>> doesn't much matter.
>> --
>> Daniel A. Morgan
>> University of Washington
>> damor..._at_x.washington.edu (replace x with u to respond)
>> Puget Sound Oracle Users Groupwww.psoug.org

> 
> Thanks for the response. The question was more related to sending the
> core files to the OS vendor. We would like to know if the core files
> will contain data and is it secure enough to send core files via
> insecure channel.

Oracle core dump files or O/S core dump files?

I would imagine with O/S files the correct answer would be "it depends" but unless you work for No Such Agency I wouldn't expect anyone would invest the time or energy to figure it out. Still it is possible.

-- 
Daniel A. Morgan
University of Washington
damorgan_at_x.washington.edu (replace x with u to respond)
Puget Sound Oracle Users Group
www.psoug.org

Received on Wed Aug 15 2007 - 10:36:25 CDT