Oracle database security, SAP security note 926023

SAP security note 926023, "Oracle Database Security", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

On October 31, 2005, the PL/SQL worm program "Oracle Worm Voyager" was released, posing a threat to Oracle databases. Although initially harmless, variants of this worm may cause significant damage. Consequently, Oracle and SAP have collaborated to evaluate and improve the security of Oracle databases used in SAP systems.

Solution

Recommendations by Oracle

Refer to Oracle Metalink Note 340009.1 for detailed Oracle recommendations on database security, particularly against Oracle Voyager Worm attacks. It includes the "Oracle Database Security Checklist" based on the "Oracle® Database 10g Release 2 Security Guide."

Recommendations by SAP and Oracle

• Lock Standard Database Users and Change Passwords: lock unused Oracle standard database users. Change known standard passwords. Example command: SQL> ALTER USER <username> ACCOUNT LOCK PASSWORD EXPIRE;
• Revoke CREATE DATABASE LINK Authorization: deactivate the CREATE DATABASE LINK privilege for users and roles that do not require it. Example commands: SQL> REVOKE CREATE DATABASE LINK FROM <username>; SQL> REVOKE CREATE DATABASE LINK FROM <role_name>;
• Reduce PUBLIC User Group Privileges: limit the privileges assigned to the PUBLIC role to only those necessary. Revoke unnecessary execute permissions on packages like UTL_SMTP, UTL_TCP, etc. Example command: SQL> REVOKE EXECUTE ON UTL_SMTP FROM PUBLIC;
• Protect the Oracle Listener: protect the listener administration with a password (up to Oracle Release 9i) or use OS authentication (Release 10g and above). Ensure the Oracle Listener administrator is part of the local DBA group.
• Change Listener Standard Port: update from 21 October, 2013 – the recommendation to change the Oracle standard listener port is no longer valid as the security of the Oracle listener is not dependent on the port number. The standard port for Oracle listener is 1521, and SAP uses 1527.

Reason and prerequisites

The primary goal is to implement actions that bolster the security of Oracle databases. Ensure you are using Oracle Release 9.2 or higher.

Update from 21 October, 2013: the note is valid for Oracle Releases 9.2 and 10.2. For Oracle Release 11.2 or higher, refer to the corresponding Oracle Database Security Guide.