SQL Injection Attacks and Defense - 2009

400 Chapter 9 • Platform-Level Defenses
IF ora_server_error(n) in ('900','906','907','911','917','920','923','933','970',
'1031','1476','1719','1722','1742','1756','1789','1790','24247','29257','29540')
THEN
-- insert the attempt including the SQL statement into a table
INSERT INTO system.oraerror VALUES (id, sysdate, ora_login_user, ora_client_
ip_address, ora_server_error(n), ora_server_error_msg(n), v_stmt);
-- send the information via email to the DBA
--
COMMIT;
END IF;
END LOOP;
--
END after_error;
/
Locking Down the Database Server
Once the application data has been secured, you still need to take a few additional steps
to harden the database server itself. In a nutshell, you want to make sure the systemwide
configuration is secured in a manner that is consistent with the security principle of least
privilege and that the database server software is up to date and patched. If you comply with
these two key directives, it will be very difficult for an attacker to access anything outside the
scope of the intended application data. Let’s take a closer look at some specific
recommendations.
Additional Lockdown of System Objects
Besides revoking public role permissions on system objects, consider taking additional steps
to further lock down access to privileged objects, such as those used for system administration,
executing operating system commands, and making network connections. Although these
features are useful to database administrators, they are also just as useful (if not more so)
to an attacker who has gained direct access to the database. Consider restricting by ensuring
that superfluous permissions are not granted to application roles, disabling access to privileged
objects systemwide via server configuration, or dropping from the server completely
(to avoid reenabling should privilege escalation occur).
On Oracle, you should restrict the ability to run operating system commands and to
access files on the operating system level from the database. To ensure that (PL/)SQL injection
problems cannot be used to run operating system commands or access files, do not grant the
following privileges to the Web application user: CREATE ANY LIBRARY, CREATE
ANY DIRECTORY, ALTER SYSTEM, or CREATE JOB. Also, you should remove the
PUBLIC grant at least from the following packages if it is not needed: UTL_FILE, UTL_
TCP, UTL_MAIL, UTL_SMTP, UTL_INADDR, DBMS_ADVISOR, DBMS_SQL, and