10 Database Security Threats Every IT Administrator Should Know

Écrit par
Brian Prince
Brian Prince
Published: Jun 22, 2010
Updated: Feb 2, 2021
2 minute read
10 Database Security Threats Every IT Administrator Should Know
eWeek Le contenu et les recommandations de produits sont indépendants de la rédaction. Nous pouvons gagner de l'argent lorsque vous cliquez sur des liens vers nos partenaires. En savoir plus


10 Database Security Threats Every IT Administrator Should Know

1

by Brian Prince


Default, Blank & Weak Username&47;Password

2

• Microsoft SQL Server Blank & Default Password• Default Oracle Username and Password• IBM DB2 Default Admin Password


SQL Injections

3

• SQL Injection Vulnerability in Oracle Database “SYS.DBMS_AQIN”• SQL injection vuln in Oracle 10gR1 database using SYS.DBMS_STREAMS_AUTH• SQL Injection in Oracle with “.ALTER_AUTOLOG_CHANGE_SOURCE” function


Extensive User & Group Privilege

4

• BUILTINAdministrator member of SYSADMIN fixed server role in MS SQLServer• Privileged Role Assignment in MS SQLServer• Oracle Account Root Privilege Escalation


Unnecessary Enabled Database Features

5

• Microsoft SQL Server Permission Granted on xp_cmdshell• Microsoft SQL Server xp_cmdshell Not Removed or Not Disabled• Microsoft SQL Server OLEDB Ad Hoc Query Allowed


Advertisement

Broken Configuration Management

6

• Sybase current audit table• Oracle Configuration Manager Installed on a production system• Microsoft SQL Server PPS configuration


Buffer Overflows

7

• SYS.OLAPIMPL_T.ODCITABLESTART Buffer Overflow in Oracle 9iR1 and 9iR2• EXECUTE privilege on DBMS_AQELM can lead to Buffer Overflow in Oracle DB• IBM Lotus Domino IMAP Cram-MD5 Buffer Overflow


Privilege Escalation

8

• SQL Injection in Oracle DBMS_AQIN allows users to escalate privilege• SQL Injection in Oracle AQADM_SYS allows users to escalate privilege• MySQL Privilege Escalation through RENAME statement


Denial of Service Attacks

9

• Oracle Denial of service DoS in SYS.KUPF$FILE_INT• MySQL Hello packet Denial of Service DoS• MySQL authenticated user Denial of Service DoS via federated engine


Unpatched Databases

10

• Oracle Critical Patch Update CPU• Latest Sybase patch not applied• MS SQL Server service pack and hot fix


Unencrypted Sensitive Data – at Rest and in Motion

11

• Oracle Network Encryption Required• Domino Server Full Text Indexed Field In Encrypted Database• Unencrypted listener password in Oracle

Brian Prince

Brian Prince

Content Writer
eWeek Logo

eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site's focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

Propriété de TechnologyAdvice. © 2026 TechnologyAdvice. Tous droits réservés

Divulgation publicitaire : Certains des produits qui apparaissent sur ce site proviennent d'entreprises dont TechnologyAdvice reçoit une compensation. Cette compensation peut influencer la façon dont les produits apparaissent sur ce site, notamment l'ordre dans lequel ils apparaissent. TechnologyAdvice n'inclut pas toutes les entreprises ou tous les types de produits disponibles sur le marché.