Feeds

Oracle bugs threaten database DoS attacks

Look out!

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Oracle has admitted that a potentially devastating security flaw could allow crackers to mount successful denial of service attacks on NT servers running its database software.

For Oracle on Windows NT, the Oracle listener process redirects connection requests to a new port and the Oracle database server creates a new thread for this port.

If a connection to the port is not made, the thread and consumed memory is lost until the server is restarted.

Because of this, if an attacker repeatedly requests redirects which aren't completed, all the memory on the server will be consumed and legitimate users will be blocked.

After this, any attempt to log in to the console results in the dreaded Blue Screen of Death and the need to reboot a system.

Internet Security Systems, whose X-Force security research team discovered the flaw, have suggested a workaround which involves using a feature called "valid node checking" on Oracle Net8 (formerly Oracle SQL*Net). This can be used to allow or deny access to Oracle server processes from network clients with specified IP addresses. More information on this is available here.

ISS has also identified four forms of denial of service attacks against the Oracle listener service that affect software working on Unix platforms. These vulnerabilities, details of which are available here, could allow an unauthenticated user to prevent other users from connecting to a database.

Oracle has produced a series of software patches to guard against the flaws that appear likely to be more difficult to exploit, and cause less damage, than the NT bug but this is so far unclear. ®

External Links

Oracle's security alert on the NT problem
... and other denial of service issues
ISS' security alerts

Related Stories

Oracle slams IBM with 9i release
Hacker fighting club launched by IT bigwigs
Oracle sees tech gloom lifting

Choosing a cloud hosting partner with confidence

More from The Register

next story
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
SMASH the Bash bug! Red Hat, Apple scramble for patch batches
'Applying multiple security updates is extremely difficult'
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Desperate VXers enslave FREEZERS in DDoS bot
Updated Spike malware targets Asia
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.