Vulnerability Note VU#857412

Oracle Transparent Data Encryption master encryption key stored as plaintext

According to Oracle, Transparent Data Encryption "allows customers to encrypt sensitive data in columns without having to manage the encryption key ... Oracle eliminates the need for views to decrypt data, because the data is transparently decrypted once a user has passed necessary access-control checks."

System Global Area (SGA)

The SGA is memory allocated by an instance of an Oracle database to store and share data among database processes and users.

The Problem

The master encryption key used by TDE is stored as plaintext in the SGA.

Based on research into public information, we believe that this issue is Oracle vuln# DB27 in the Oracle CPU for January 2006. However, there is not sufficient information to authoritatively relate Oracle vulnerability information to information provided by other parties.

II. Impact

This issue is corrected in the Oracle Critical Patch Update for January 2006.

Systems Affected

http://www.us-cert.gov/cas/techalerts/TA06-018A.html
http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html
http://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.html
http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html

Credit

This vulnerabilty was reported by Alexander Kornbrust of red-database security.

This document was written by Jeff Gennari.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.