[NEWS] Oracle Fine Grained Auditing Issue

From: SecuriTeam (support_at_securiteam.com)
Date: 05/08/05

  • Next message: SecuriTeam: "[EXPL] Ethereal SIP Dissector Overflow (Exploit)"
    To: list@securiteam.com
    Date: 8 May 2005 17:40:45 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Oracle Fine Grained Auditing Issue
    ------------------------------------------------------------------------

    SUMMARY

    Fine grained audit (FGA) does not work if the user SYS runs a SELECT
    statements. There are 2 issues. The SELECT statement issued by SYS is not
    audited. Once SYS selects the table all subsequent SELECTs by other users
    are NOT audited.

    DETAILS

    Vulnerable Systems:
     * Oracle Database 9i
     * Oracle Database 10g

    Workaround:
    Do not run SQL for FGA objects as user SYS. Flush the shared pool to
    activate auditing again.

    Test case:
    1. Create user and objects and add policy.
    connect /as sysdba
    grant dba to fga identified by fga;
    conn fga/fga
    create table emp as select * from scott.emp;
    execute dbms_fga.add_policy(object_schema=>'FGA',
    object_name=>'EMP',policy_name=>'FGA_POLICY');

    2. Run SQL from fga user
    conn fga/fga
    select count(*) from fga.emp;
    select sql_text,to_char(timestamp,'HH24:MI:SS') time
    from sys.dba_fga_audit_trail;

    --> It will return 1 row.

    3. Run SQL from SYS user
    conn /as sysdba
    select count(*) from fga.emp;
    select sql_text,to_char(timestamp,'HH24:MI:SS') time
    from sys.dba_fga_audit_trail;

    --> It will return 1 row which was obtained by step 2.

    A new row was not inserted.

    4. Run SQL from fga user again
    conn fga/fga
    select count(*) from fga.emp;
    select sql_text,to_char(timestamp,'HH24:MI:SS') time
    from sys.dba_fga_audit_trail;

    --> It will return 1 row which was obtained by step 2.

    A new row was not inserted again.

    Patch Information:
    Apply patchset 10.1.0.4. for Oracle 10g. This bug is not fixed in 9.2.0.6
    with the latest patches from Oracle Critical Patch Update April 2005
    applied.

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:ak@red-database-security.com> Alexander Kornbrust.
    The original article can be found at:
    <http://www.red-database-security.com/advisory/oracle-fine-grained-auditing-issue.html> http://www.red-database-security.com/advisory/oracle-fine-grained-auditing-issue.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[EXPL] Ethereal SIP Dissector Overflow (Exploit)"