Testing for DB Listener (OWASP-CM-002)
The Data base listener is a network daemon unique to Oracle databases. It waits for connection requests from remote clients. This daemon can be compromised and hence affect the availability of the database.
Description of the Issue
The DB listener is the entry point for remote connections to an Oracle database. It listens for connection requests and handles them accordingly.
The listener by default listens on port 1521, it is good practice to change the listener from this port to another arbitary port number.
If this listener is "turned off" remote acess to the database is not possible. If this is the case ones application would fail also creating a denial of service attack.
Potential areas of attack:
- Stop the Listener - Hence creating a DoS attack.
- Set a password and prevent others from controlling the Listener - Hijack the DB.
- Write trace and log files to any file accessible to the process owner of tnslnsr (usually Oracle) - Possible information leakage.
- Obtain detailed information on the Listener, database, and application configuration.
Black Box testing and example
Upon discovering the port on which the listener resides one can assess the listener by running a tool developed by Integrigy:
The tool above checks the following: Listener Password On many Oracle systems the listener password may not be set. The tool above verifies this. If the password is not set an attacker could set the password and hijack the listener, albeit the password can be removed by locally editing the Listener.ora file.
Enable Logging The tool above also tests to see if logging has been enabled. If it has not one would not detect any change to the listener/or have a record of it and also detection of brute force attacks on the listener would not be audited.
Admin Restrictions If Admin restrictions are not enabled it is possible to use the "SET" commands remotley.
Gray Box testing and example
Testing for Topic X vulnerabilities:
TNS Listener tool (Perl)
OWASP Testing Guide v2
Here is the OWASP Testing Guide v2 Table of Contents