Voyager (Computer worm)
Encyclopedia
The Voyager worm is a computer worm
that was posted on the Internet on October 31, 2005, and is designed to target Oracle databases.
The December 29, 2005 version attempts to create private database links in affected databases, but the procedure to spread is missing. If activated, it will grant DBA to PUBLIC. An AFTER LOGON trigger may run which performs a Google search for its own code. The worm code tries to mail the username and password hashes to larry@oracle.com and oracle@. It tricks the listener to reset the password for a well known database user. The clear intention is to increase the chances of successfully creating a private link to the database.
Computer worm
A computer worm is a self-replicating malware computer program, which uses a computer network to send copies of itself to other nodes and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a computer virus, it does not need to attach...
that was posted on the Internet on October 31, 2005, and is designed to target Oracle databases.
Known variants
- First, non-malicious, example October 31, 2005
- Second example December 29, 2005, which attempts to stop remote Oracle listeners on machines that have not been properly secured.
Actions
The October 31 variant has a harmless payload, but could easily be modified.The December 29, 2005 version attempts to create private database links in affected databases, but the procedure to spread is missing. If activated, it will grant DBA to PUBLIC. An AFTER LOGON trigger may run which performs a Google search for its own code. The worm code tries to mail the username and password hashes to larry@oracle.com and oracle@
- Application Security Inc. (2006). "New Oracle Voyager Worm Variant". Retrieved Jan. 11 2006.
Spread
The October 31 variant tries to find other Oracle databases in the same subnet and uses private database links to connect to remote databases. The December 29 variant was posted incomplete, without a spreading mechanism.Outbreaks
- October 31, 2005 – First posted on the Internet
- December 29, 2005 – Malicious variant (incomplete) posted on the Internet
External links
- Database Security (Oracle Corp)
- Security Checklist (Oracle Corp) (pdf file)
- Voyager worm described at Application Security Inc.
- Analysis Voyager worm at Red-Database-Security GmbH