RE: oracle VA/PT

["Josh Perrymon" <perrymonj () networkarmor com>]

I have never known for Nessus not to find that Issue with Oracle. I have
done several Assessments in the last week and it found defaults in
Oracle, MySQL, and MSQL. Also found missing patches and no Listener
passwords.

You may want to run Absinthe on it and see what comes up.

JP
Network Armor

-----Original Message-----
From: Massimo [mailto:massimo.mail () quipo it] 
Sent: Tuesday, September 27, 2005 12:07 AM
To: pen-test () securityfocus com
Subject: oracle VA/PT

Hi to all.

Some day ago I was quite surprised to see that on a server that was 
scanned with nessus and with emaze scanner that revealed no relevant 
security hole, there was oracle installed and active with all the 
default oracle user/password activated (i.e. system/manager, 
scott/tiger, etc).

What VA tool can find default user on oracle? Is it possible to find 
that info with Nessus (perhaps I can't use it at its best)?

Best Regards,
                Massimo
PS
I usually activate all the check on nessus and emaze.

------------------------------------------------------------------------
------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on
your 
website. Up to 75% of cyber attacks are launched on shopping carts,
forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers
are 
futile against web application hacking. Check your website for
vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before
hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
------------------------------------------------------------------------
-------





------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------