Proof of concept worm targets Oracle databases

Powered by SC Magazine
 

An anonymous developer has published details of a proof-of-concept worm engineered to compromise Oracle databases which have been left with default user accounts and passwords.

According to a warning on the Full-Disclosure mailing list, the worm uses the UTL_TCP package to scan for remote Oracle databases on the same local network. Upon finding another database, the SID is retrieved and the worm uses several default username and password combinations to attempt to login to the remote database.

Currently, the worm's recorded default/username password list includes the following combinations: system/manager; sys/change_on_install; dbsnmp/dbsnmp; outln/outln; scott/tiger; mdsys/mdsys and ordcommon/ordcommon.

"When the worm discovers a default username and password, it creates a table "X" in the current user's schema with a date column called "Y". This could easily be changed to a more dramatic payload," warned the SANS Internet Storm Center.

In its current state, the worm is not deemed a "terribly significant" threat. However, security experts at SANs warned that data base administrators should treat the malware as "an early warning sign for future variants of the worm that include additional propagation methods".

Database security watcher Red Database Security agreed with this assessment: "The initial version of the worm must be started in the database manually but it is possible to use the glogin.sql feature of sqlplus to do this without the knowledge of the (database) user if it is possible to modify the file glogin.sql."

According to SANS, Oracle DBA's can take actions to mitigate the effect of this worm including changing the Oracle listener from the default port of TCP/1521 and setting a listener password.

Protection can also be enhanced by dropping or locking default user accounts where possible and ensuring that all default accounts do not use default passwords. Other precaution include revoking PUBLIC privileges to the UTL_TCP, UTL_INADDR packages and ensuring that CREATE DATABASE LINK privileges are not granted to users who do not need to link to remote databases.

www.red-database-security.com/advisory/oracle_worm_voyager.html
www.sans.org

Copyright © SC Magazine, US edition


 
 
 
Top Stories
NSW to build its own myGov
Service NSW digital profiles available by September.
 
Android bug leaves a billion phones open to attack
Hackers only need phone number to target devices.
 
Australia's leaders agree to end GST-free online goods
Gerry Harvey may finally get his way.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  13%
 
No
  51%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  19%
TOTAL VOTES: 711

Vote