Oracle 8 tns-listener security

Question

Hi list,
premise that an upgrade to a newer Oracle version is recommended... I noticed setting a tns-listener password in Oracle 8.1.7* ("SECURITY=ON"), the SIDs are anyway enumerable (via "Command=status").
According to you, is firewall filtering the only possible solution?
As for "Oracle8 tns security" I did not find information on google. For Oracle 9 is different.
Thanks in advance,
Al

Answer 1

user8798619 wrote:
Using metasploit modules tnscmd and sid_enum (http://www.metasploit.com) or tnscmd (www.jammed.com/~jwa/hacks/security/tnscmd/tnscmd). The request to Oracle 8.1.7.0.0 tns-listener: (COMMAND=STATUS).
The result (* obscured):
(DESCRIPTION=(TMP=)(VSNNUM=*********)(ERR=0)(ALIAS=LISTENER)(SECURITY=ON)(VERSION=TNSLSNR for Solaris: Version 8.1.7.0.0 - Production)(START_DATE=********)(SIDNUM=1)(LOGFILE=***********)(PRMFILE=************)(TRACING=off)(UPTIME=321588456)(SNMP=OFF))(ENDPOINT=(HANDLER=(STA=ready)(HANDLER_MAXLOAD=0)(HANDLER_LOAD=0)(ESTABLISHED=0)(REFUSED=0)(HANDLER_ID=**************)(PRE=ttc)(SESSION=NS)(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=TEST123))))),,(ENDPOINT=(HANDLER=(STA=ready)(HANDLER_MAXLOAD=0)(HANDLER_LOAD=0)(ESTABLISHED=0)(REFUSED=0)(HANDLER_ID=**************)(PRE=ttc)(SESSION=NS)(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC))))),,(ENDPOINT=(HANDLER=(STA=ready)(HANDLER_MAXLOAD=0)(HANDLER_LOAD=0)(ESTABLISHED=0)(REFUSED=0)(HANDLER_ID=*********************)(PRE=ttc)(SESSION=NS)(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=testlab)(PORT=1521))))),,(SERVICE=(SERVICE_NAME=TEST123)(INSTANCE=(INSTANCE_NAME=TEST123)(NUM=1)(INSTANCE_CLASS=ORACLE)(NUMREL=1))),,
Without credentials but with "SECURITY=ON" are obtained:
Version: TNSLSNR for Solaris: Version 8.1.7.0.0 - Production
Logfile: *********
Sid: TEST123
Hostname: testlab
Uptime: 321588456
According to "documentation in internet", with "SECURITY=ON", the password is configured (for example http://www.integrigy.com/files/Integrigy_Oracle_Listener_TNS_Security.pdf).
I hope I am wrong :)Having no knowledge of how the cited tools work, I'll have to defer ...