Auditing databases for security vulnerabilities
Disclosed herein are methods, systems, and processes to audit databases for security vulnerabilities. A server connects to a database and retrieves security information indicating security vulnerabilities associated with the database. A scanning program scans the database to identify the security vulnerabilities by executing subprograms stored in the database. The server accesses the security information using stored program units stored in the database, and stores the security information that identifies the security vulnerabilities in a repository database.
1. A computer-implemented method comprising:
connecting, by a server, to a database of a plurality of databases;
retrieving from the database, security information indicating one or more security vulnerabilities associated with the database;
scanning, by a scanning program implemented in a web application that is hosted by a web server, the database to identify the one or more security vulnerabilities wherein
the scanning program is configured to execute a single server process facilitated by an application service layer on the web server,
the single server process includes stored program unit commands;
executing, by the scanning program, one or more subprograms stored in the database using the stored program unit commands;
invoking, by the one or more subprograms in the database, one or more stored program units in the database;
accessing, by the one or more subprograms, the security information using the one or more stored program units stored in the database based on the stored program unit commands; and
storing the security information in a repository database, wherein
the security information comprises the one or more security vulnerabilities.
2. The computer-implemented method of claim 1 , wherein
a stored program unit of the one or more stored program units is used to retrieve a portion of the security information from the database, and
the portion of the security information is associated with a security vulnerability of the one or more security vulnerabilities.
3. The computer-implemented method of claim 2 wherein
the portion of the security information comprises privilege escalation data, Structural Query Language (SQL) injection data, Transparent Network Substrate (TNS) poison data, system package data, user account data, or database auditing data.
4. The computer-implemented method of claim 1 , further comprising:
connecting, by the server, to a further database of the plurality of databases;
retrieving from the further database, by executing the scanning program, further security information indicating one or more security vulnerabilities associated with the further database; and
storing the further security information in the repository database.
5. The computer-implemented method of claim 1 , wherein
the repository database is accessible via a web interface implemented by the server.
6. The computer-implemented method of claim 1 , wherein
the web application is implemented using procedural language extensions to a structured query language.
7. The computer-implemented method of claim 1 , further comprising:
executing the scanning program using the web application to scan the plurality of databases for the one or more security vulnerabilities.
8. The computer-implemented method of claim 1 , wherein
a subprogram of the one or more subprograms is a procedure or a function, and
the subprogram comprises one or more parameters with differing values.
9. The computer-implemented method of claim 2 , wherein
the stored program unit is a procedure, a function, or a package, and
the stored program unit comprises one or more label security privileges associated with the security information.
10. A non-transitory computer readable storage medium comprising program instructions executable to:
connect, by a server, to a database of a plurality of databases;
retrieve from the database, security information indicating one or more security vulnerabilities associated with the database;
scan, by a scanning program implemented in a web application that is hosted by a web server, the database to identify the one or more security vulnerabilities, wherein
the scanning program is configured to execute a single server process facilitated by an application service layer on the web server,
the single server process includes stored program unit commands;
execute, by the scanning program, one or more subprograms stored in the database using the stored program unit commands;
invoke, by the one or more subprograms in the database, one or more stored program units in the database;
access, by the one or more subprograms, the security information using one or more stored program units stored in the database based on the stored program unit commands; and
store the security information in a repository database, wherein
the security information comprises the one or more security vulnerabilities.
11. The non-transitory computer readable storage medium of claim 10 , wherein
a stored program unit of the one or more stored program units is used to retrieve a portion of the security information from the database,
the portion of the security information is associated with a security vulnerability of the one or more security vulnerabilities, and
the portion of the security information comprises privilege escalation data, Structural Query Language (SQL) injection data, Transparent Network Substrate (TNS) poison data, system package data, user account data, or database auditing data.
12. The non-transitory computer readable storage medium of claim 10 , wherein
the web application is implemented using procedural language extensions to a structured query language.
13. The non-transitory computer readable storage medium of claim 12 , further comprising:
executing the scanning program using the web application to scan the plurality of databases for the one or more security vulnerabilities.
14. The non-transitory computer readable storage medium of claim 10 , wherein
a subprogram of the one or more subprograms is a procedure or a function, and
the subprogram comprises one or more parameters with differing values.
15. The non-transitory computer readable storage medium of claim 11 , wherein
the stored program unit is a procedure, a function, or a package, and
the stored program unit comprises one or more label security privileges associated with the security information.
16. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
connect, by a server, to a database of a plurality of databases;
retrieve from the database, security information indicating one or more security vulnerabilities associated with the database;
scan, by a scanning program implemented in a web application that is hosted by a web server, the database to identify the one or more security vulnerabilities, wherein
the scanning program is configured to execute a single server process facilitated by an application service layer on the web server,
the single server process includes stored program unit commands;
execute, by the scanning program, one or more subprograms stored in the database using the stored program unit commands;
invoke, by the one or more subprograms in the database, one or more stored program units in the database;
access, by the one or more subprograms, the security information using one or more stored program units stored in the database based on the stored program unit commands; and
store the security information in a repository database, wherein
the security information comprises the one or more security vulnerabilities.
17. The system of claim 16 , wherein
a stored program unit of the one or more stored program units is used to retrieve a portion of the security information from the database,
the portion of the security information is associated with a security vulnerability of the one or more security vulnerabilities, and
the portion of the security information comprises privilege escalation data, Structural Query Language (SQL) injection data, Transparent Network Substrate (TNS) poison data, system package data, user account data, or database auditing data.
18. The system of claim 16 , wherein
the web application is implemented using procedural language extensions to a structured query language.
19. The system of claim 16 , further comprising:
executing the scanning program using the web application to scan the plurality of databases for the one or more security vulnerabilities.
20. The system of claim 16 , wherein
a subprogram of the one or more subprograms is a procedure or a function,
the subprogram comprises one or more parameters with differing values,
the stored program unit is a procedure, a function, or a package, and
the stored program unit comprises one or more label security privileges associated with the security information.