Proof of concept worm targets Oracle databases

Powered by SC Magazine
 

An anonymous developer has published details of a proof-of-concept worm engineered to compromise Oracle databases which have been left with default user accounts and passwords.

According to a warning on the Full-Disclosure mailing list, the worm uses the UTL_TCP package to scan for remote Oracle databases on the same local network. Upon finding another database, the SID is retrieved and the worm uses several default username and password combinations to attempt to login to the remote database.

Currently, the worm's recorded default/username password list includes the following combinations: system/manager; sys/change_on_install; dbsnmp/dbsnmp; outln/outln; scott/tiger; mdsys/mdsys and ordcommon/ordcommon.

"When the worm discovers a default username and password, it creates a table "X" in the current user's schema with a date column called "Y". This could easily be changed to a more dramatic payload," warned the SANS Internet Storm Center.

In its current state, the worm is not deemed a "terribly significant" threat. However, security experts at SANs warned that data base administrators should treat the malware as "an early warning sign for future variants of the worm that include additional propagation methods".

Database security watcher Red Database Security agreed with this assessment: "The initial version of the worm must be started in the database manually but it is possible to use the glogin.sql feature of sqlplus to do this without the knowledge of the (database) user if it is possible to modify the file glogin.sql."

According to SANS, Oracle DBA's can take actions to mitigate the effect of this worm including changing the Oracle listener from the default port of TCP/1521 and setting a listener password.

Protection can also be enhanced by dropping or locking default user accounts where possible and ensuring that all default accounts do not use default passwords. Other precaution include revoking PUBLIC privileges to the UTL_TCP, UTL_INADDR packages and ensuring that CREATE DATABASE LINK privileges are not granted to users who do not need to link to remote databases.

www.red-database-security.com/advisory/oracle_worm_voyager.html
www.sans.org

Copyright © SC Magazine, US edition


 
 
 
Top Stories
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
The CISO’s dilemma: Do you trust your partner’s partner?
[Blog post] How far down the chain do you check?
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 310

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 118

Vote