| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
 |
 | |||
| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
|
| |||
Home -> Community -> Mailing Lists -> Oracle-L -> Security risk with catsnmp catalog
Hi Listers,
There is a security risk with catsnmp catalog
(<ORACLE_HOME>/rdbms/admin/catsnmp.sql)
which is shipped with Oracle releases.
This is generic.
Details :
this file drop and recreate user dbsnmp with default password
"dbsnmp" and give him different privileges.
For 8i releases, it is mostly V_$ views privileges
But for 9i releases, it will grant "SELECT ANY DICTIONARY"
privilege (this one give access to any sys objects like link$ if
you see what i mean...).
One can argue that the security policy of the site should ensure that
default password must be changed.
But even in this case, I'm sure that over the time many databases will
reverse
to the default password because catproc.sql (which execute automatically
catsnmp) is required when applying patchsets and sometimes individual
patches.
I opened a TAR and the support analyst referred me to bug #2432163 which is visible (i thought naively that all security problems were kept out from prying eyes...)
As a patch will probably take some time, i asked Oracle to place an alert accordingly .
In the meantime, if you don't use OEM, i strongly suggest that you 1- execute <ORACLE_HOME>/rdbms/admin/catnsnmp.sql to remove this stuff 2- remove <ORACLE_HOME>/bin/dbsnmp which is by default setuid root
(at least if you have followed install procedures and run root.sh)
Unbreakable...or autobreakable ;-)
Regards
Gilles Parc
carpe diem !!
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Gilles PARC
INET: gparc_at_online.fr
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists --------------------------------------------------------------------To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). Received on Sun Aug 11 2002 - 17:33:17 CDT
 |
 |