Oracle security risk on Windows NT
All versions of Oracle running on Windows NT are open to a security flaw that can cause the system to crash, according to security management specialist Internet Security Systems. A security alert on the company's Web site states, "This vulnerability causes a Windows NT system to consume 100% of available memory. Access to the server is denied and a full reboot is required."
Worryingly, ISS has found that it is also possible for remote users to deny access to all other users and cause the system to crash. In effect this is the same as launching a denial of service attack on an Oracle server running under Windows NT...
Oracle security risk on Windows NT
Monday 25 June 2001 by Cliff Saran
The problem occurs within the Oracle network redirection software used to connect the database from a network connection. According to ISS, it is possible for a hacker to abuse the Oracle server's network software by repeatedly requesting to be redirected and then not connecting to the waiting network port.
ISS said that this would cause the Oracle server to consume all memory on the server. Once this has happened, any attempt to log in results in the operating system crashing.
The company has advised users to configure the Oracle Net8 (formerly Oracle SQL*Net) software to use a feature called "valid node checking". This enables a network or database manager to deny access to the Oracle server from network devices with specified IP addresses.
SNP.
