{"vuid":"VU#857412","idnumber":"857412","name":"Oracle Transparent Data Encryption master encryption key stored as plaintext","keywords":["Oracle","information disclosure","master encryption key","transparent data encryption","TDE","plain text","SGA","oracle_cpu_january_2006","DB27"],"overview":"Oracle Transparent Data Encryption master encryption key is stored as plaintext, which could allow an attacker to decrypt and read sensitive information within the database.","clean_desc":"Transparent Data Encryption (TDE) According to Oracle, Transparent Data Encryption \"allows customers to encrypt sensitive data in columns without having to manage the encryption key ... Oracle eliminates the need for views to decrypt data, because the data is transparently decrypted once a user has passed necessary access-control checks.\" System Global Area (SGA) The SGA is memory allocated by an instance of an Oracle database to store and share data among database processes and users. The Problem The master encryption key used by TDE is stored as plaintext in the SGA. Based on research into public information, we believe that this issue is Oracle vuln# DB27 in the Oracle CPU for January 2006. However, there is not sufficient information to authoritatively relate Oracle vulnerability information to information provided by other parties.","impact":"If an attacker can gain access to SGA memory, that attacker may be able to retrieve the TDE master key. Once the key is obtained, the attacker will be able to decrypt and read sensitive information within the database.","resolution":"Apply patches \nThis issue is corrected in the Oracle Critical Patch Update for January 2006.","workarounds":"","sysaffected":"","thanks":"This vulnerabilty was reported by \nAlexander Kornbrust of \nred-database security","author":"This document was written by Jeff Gennari.","public":["http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html","http://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.html","http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html"],"cveids":["CVE-2006-0270"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-07-11T18:46:52Z","publicdate":"2005-01-17T00:00:00Z","datefirstpublished":"2006-01-19T19:10:26Z","dateupdated":"2006-03-17T15:22:33Z","revision":30,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"3","cam_population":"15","cam_impact":"15","cam_easeofexploitation":"9","cam_attackeraccessrequired":"7","cam_scorecurrent":"4.7840625","cam_scorecurrentwidelyknown":"6.11296875","cam_scorecurrentwidelyknownexploited":"11.42859375","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":4.7840625,"vulnote":null}