|
Oracle Trace Collection Security Vulnerability
October 23, 2001
This vulnerability affects all versions of Oracle running on UNIX.
The SETUID bit on the executable file "otrcrep" can be exploited. The SETUID
bit should be removed on all Oracle trace files including: otrccol,
otrccref, otrcfmt, otrccrep.
The best recommendation for any installation of Oracle on UNIX is to limit
access to the ORACLE_HOME directory to database administrators only. This can
be done by changing the permissions on the ORACLE_HOME directory to 770.
For additional details from Oracle, download the file
http://otn.oracle.com/deploy/security/pdf/otrcrep.pdf
|
