Software Engineering Institute

Transparent Data Encryption (TDE)

According to Oracle, Transparent Data Encryption "allows customers to encrypt sensitive data in columns without having to manage the encryption key ... Oracle eliminates the need for views to decrypt data, because the data is transparently decrypted once a user has passed necessary access-control checks."

System Global Area (SGA)

The SGA is memory allocated by an instance of an Oracle database to store and share data among database processes and users.

The Problem

The master encryption key used by TDE is stored as plaintext in the SGA.

Based on research into public information, we believe that this issue is Oracle vuln# DB27 in the Oracle CPU for January 2006. However, there is not sufficient information to authoritatively relate Oracle vulnerability information to information provided by other parties.

If an attacker can gain access to SGA memory, that attacker may be able to retrieve the TDE master key. Once the key is obtained, the attacker will be able to decrypt and read sensitive information within the database.

Apply patches
This issue is corrected in the Oracle Critical Patch Update for January 2006.