TECH Signal 439
Oracle database attack uses Java source to bypass all 1,449 patches
↗
Attackers used SQL injection and then loaded a Java toolkit directly into an Oracle database, a technique that works even on fully patched systems.
This attack shows that patching alone cannot protect Oracle databases. The novel use of Oracle's embedded Java Virtual Machine to store and compile malicious code as a database object means admins must also secure application-layer inputs and monitor for unusual database objects.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Oracle's July patch dump included 1,449 patches, but none would have prevented this credential theft.
The attack began with a simple SQL injection on a public-facing web app.
Attackers used CREATE JAVA SOURCE commands to load a toolkit called khunt directly into the Oracle database.
THE CLUSTER