SHATTER Security Alerts

DbProtect AppRadar Filters™ - 13 June 2006

Oracle Critical Patch Update - April 2006

• Empowers your organization to monitor activity surrounding those objects that are susceptible to the vulnerabilities addressed by this Critical Patch Update. Apply this filter to observe and understand how these susceptible objects are used within your environment.

• Empowers your organization to monitor the procedures that are vulnerable to SQL injection. It is important to monitor these procedures as there are public exploits available.

• Download this DbProtect AppRadar filter

1. Unzip the zip file onto your desktop.
2. Login to the management console for DbProtect AppRadar.
3. Go to the Filters page by clicking on the "Filters" tab.
4. Find the Import Filters section and click on the "Import" button.
5. Select the "OracleAprilCPUFilters_20060613.xml" file to import. Click on "Import".
6. Repeat steps 4 and 5 to import the
"OracleExtprocSQLInjection_20060613.xml" file.
7. Now we need to add those Filters to a Policy. Click on the "Policies" tab.
8. Find the Policy that you are using to monitor your target database and click the corresponding "Edit" button.
9. The Policy Editor window will open.
10. The left-pane of the Policy Editor contains a tree-view of all of the available Rules and Filters. Expand "Oracle Database" by clicking on the "+" sign.
11. The 3rd category from the top will be "Audit Events". Expand that category by clicking the "+" sign.
12. Scroll down until you find the "Stored procedure executed" Rule. There should be a "+" sign next to it. Expand that.
13. Now you should see the 2 Filters that were just imported: a) Export xproc SQL injection - vulnerable procedure usage (unpatched); and b) Critical Patch Update April 2006 - Vulnerable procedures usage.
14. To turn on those Filters, simply toggle their corresponding checkboxes until the check is visible.
15. Scroll back to the top in the pane with the tree, and click on "Save".
16. Now in the Policies page, find the Policy you just edited, and click on the "Deploy..." button to begin the deployment process. Deploying the Policy to the appropriate databases will immediately begin monitoring.