391424375

ÐÏࡱá>þÿ 
!
þÿ 
ÿ 
ÿ 
BÃD
Å
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 


!
"#$%&'()*+
Ryan Corvetti B°a=
œ¯¼=àL;x-8@"·Ú1Èÿ 
Arial1Èÿ 
Arial1Èÿ 
Arial1Èÿ 
Arial1 ÿ 
Arial1ÈArial1È$Arial1ÜArial1ÈArial1È
Arial1Èÿ 
¼Arial"$"#
à
11@|@ @
à11@t@ @ À à
11@|@ @ À à1À à1@À àÀ àÀ àX
“€ÿ 
“ÿ 
“ÿ 
“ÿ 
“ÿ 
“ÿ 
“ÿ 
“
Normal_Sheet1“ÿ 
’â8ÿ 
ÿ 
ÿ 
Ý·Ôüóò„«êdq:F¥€€ÀÀÀ€€€™™ÿ 
™3fÿ 
ÿ 
ÌÌÿ 
ÿ 
ffÿ 
€€fÌÌÌÿ 
€ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
€€€€€ÿ 
Ìÿ 
Ìÿ 
ÿ 
Ìÿ 
Ìÿ 
ÿ 
™™Ìÿ 
ÿ 
™ÌÌ™ÿ 
ÿ 
Ì™3fÿ 
3
defaultpasswords……defaultportsfororacle…‘
PLSQLVULNSCPUŒ

®


7paulOracle_D
atabase_Checklist;PÁ
Á
ß®


ü Hô
› It is recommended to log auditing to the OS.
Select value from v$parameter where name = 'audit_trail';
Set to OS
Please note on Windows OS trails are recorded to the Application Event Logs.
It is recommended to audit at least all SYS actions.
Select value from v$parameter where name = 'audit_sys_operations';
Set to TRUE (this parameter is new in 9iR2)
Plus to audit certain critical actions like selecting the password hashes. This is object auditing which would look like this:
AUD
IT SELECT ON SYS.USER$ BY ACCESS
Please note that compliance with data standards such as Sarbannes Oxley
or using the NTFS file permissions.
Also recommend taking a hash of the file so that it can be seen that is the same.listener logging enabled_Brute force attempt
LOGGING_LISTENER=ONnone needed Restrict sources of connectionsgvalid node checking can be set so that only author
tcp.validnode_checking=YES
tcp.invited_nodes =(10.1.1.161
tcp.excluded_nodes=(10.1.1.160
.Use connection manager to restrict by source4553A3B443FB3207RENG is a schema account from Oracle Applications. D
e
ESTOREUSERESTORE51063C47AC2628D
46ESTOREUSER is an administration account for WebSphere.EVENT7CA0A42
Check the permissions which should be 600 or similar.
Secure the wallet directory for OID
.$Shoud not be much discussion needed.¾This is a hypothetical example given that hr_tab
(select name from sys.user$)minus
(select valid_users from hr_table);
The result would be invalid users.
This point clearly needs implementing the only question should be how which would be business process decision. It would be
http://www.cs.umbc.edu/help/oracle8/server.815/a67775/ch2x_mts.htmCan also use an Oracle aware firewall instead but Ora
adduser <username> <groupname>
Adds username to the group groupnameGthere may be additional discussion on who exactly will be a member of the OSD
BA
There should be a process that can identify accounts that are not being used anymore so that they can be removed.Native PL
Both requirements can be met by setting the parameters for the developer as the PLSQL needs compiling and then setting it b
ORACLE user account created to own the Oracle software should not be called "oracle"
The user should be a local admin and not a domain user.
This user should be made part of a group not c< alled ORA_D
BA.
Remove everyone using inherited permissions.ŠThis will prevent malicious access to the Oracle software on the server as lon
TEMP=/u01/temp; export TEMP
TMPD
IR=/u01/temp; export TMPD
IR0EF5997D
C2638A617ABBCF4BEB7854B2QS_WS24ACF617D
D
7D
8F2F0447F2F756B

Page 1
 391424375

SD
OS_ICSAPC789210ACC24D
A16¬
select Count(1)
from dba_objects
where object_type Like '%JAVA%';
--if this returns more than 3000 java is installed.

This query will show the privs given wiithin Java select grantee
from dba_java_policy
where grantee not like 'JAVA%'
and grantee<>'SYS'
/
Then revoke privs not need using dbms_java.revoke_permission
remove Java completely if not needed using
$ORACLE_HOME/javavm/install/rmjvm.sql
Secure Con Text>PORTAL30_AD
MIN is the administration account of Oracle Portal.
PORTAL30_D
EMOCFD
1302A7F832068PORTAL30_PS333B8121593F96FBPORTAL30_PUBLIC42068201613CA6E2PORT
POWERCARTUSER2C5ECE3BEC35CE69PRIMARY70C3248D
FFB90152PSAFF4B266F9E61F911[PSA is a schema accou
OSSAQ_HOSTIOSSAQ_HOST is an administrative account of Oracle9iAS Syndication Server.OSSAQ_PUB?OSSAQ_PUB i
PORTAL_APPPORTAL_D
EMOA0A3A6A577A931A3
PORTAL_PUBLIC
PORTAL_SSO_PSD
1FB757B6E3D
8E2FPORTAL30969F9C3839672C6D
.PORTAL30 is the schema owner of Oracle Portal.P
version 3.1.1QPreferably
It is also preferable that the ARCHIVELOGs are kept remotely so that if the local machine becomes unusable the logs are not
ORD
PLUGINS88A2B2C183431F00?ORD
PLUGINS is an administrative account for Oracle Time Series.ORD
SYS7EFA02EC
EARLYWATCHSUPPORT8AA1C62E08C76445EASTC5D
5C455A1D
E5F4D
EC6A066C462B62D
D
46QEC is a schema accou
fine grained audit may be a requirement for compliancy sake so not negotiable but should only be needed for sensitive data.
‘Using a schema owner to access the databaes means that all objects within that schema become available as well as any hi
The question is how much and how often which is a business decision sensitive to the security needs of that department.$Lim
The auditing role should be limited to a small group and separate from the main D
BA function so that they are independent.zT
select grantee
from dba_sys_privs
where privilege like '%AUD
IT%';
Rshould be unnegotiable. Please note that the newest functionality in Oracle database called database vault is specifically de
Make sure the audit is backed up and purged so that the disk does not fill to cause D
oS or lose audit logs.+Use triggers for ro
Event Viewer
audit update on sys.salaries whenever not successful;kAs long as the action being audited should not occur often and the act
AUD
IT SESSION';zWill this affect performance. Best to test beforehand on dev server or at a time when contigencies have be
Audit grant
Review audit logs»select * from dba_audit_trail; This is a large view and there fore best read through a client like SQLD
evelo
As someone is going to need to read and react to this audit this is another reason for selectively auditing the most important e
Syslogng is also worth looking at for this purpose.†May be too time consuming for the benefit but this is potentially very benef
SQL> select table_name
TABLE_NAME D
EFAULT_D
IRECTORY_NAME
------------------------------ ------------------------------
SALES_TRANSACTIONS_EXT D
ATA_FILE_D
IR

SQL> select * from all_directories where directory_name = 'D
ATA_FILE_D
IR';

OWNER D
IRECTORY_NAME
------------------------------ ------------------------------

Page 2
 391424375

D
IRECTORY_PATH
--------------------------------------------------------------------------------
SYS D
ATA_FILE_D
IR
/u01/app/oracle/product/9.2.0/demo/schema/sales_history/
ls -al /u01/app/oracle/product/9.2.0/demo/schema/sales_history/
SQL> select grantee

GRANTEE PRIVILEGE
------------------------------ ----------------------------------------
SH READ

Muse the following command at the OS.

Wrap iname =infile oname=outfile
Wrapping the PLSQL is not a high security measure as it has been reverse engineered.
Search for unwrapped code using the following.

select owner

select owner
ID
EMO_USER739F5BC33AC03043IEBA695699F0F71C300‚D
epending on both the components installed and the version of
Please note that many vulnerabilities do not get patched for a long time so a member of the team should be tasked with monit
http://www.securityfocus.com/archive/1
For example http://www.securityfocus.com/archive/1/432078
http://ww.packetstormsecurity.nl/
As well as the Oracle Security website.
http://www.oracle.com/technology/deploy/security/alerts.htm
Plus specialist D
atabase security websites such as www.databasesecurity.com
It is not just Oracle vulnerabilities but also the supporting OS.2Application authenticaion vs Oracle authentication If true then c
This is a link that discusses the weaknesses of Oracles network authentication mechanism. http://www.fors.com/eoug97/pape
Check for evidence of development work by comparing the timestamps on the view dba_objects. If the last_ddl_time is after d
Linked to FGA is Virtual Private D
atabases which allows segregation of data between users so that they are as if they were in
Oracle Label Security use user labels to grant access at the row level.5.12.025.13.015.13.025.02.025.02.015.03.015.04.015.0
In essence the problem is code that forms dynamic SQL allowing SQL key symbols as input which instead of being parsed as
mThere are a number of cures for this
http://www.ngssoftware.com/papers/D
BMS_ASSERT.pdf
Prepared statements are used in Java as well to stop this problem.
The classic way to find these bugs is to insert a single quote into a text input field. This can be interpreted as a break i< n atte
Applications that are allowed to access Oracle should be registered using D
BMS_APPLICATION_INFOåTools such as Toad
This process is recommended especially if the source has proprietary code within it. A good reason for wrapping for example w
D
ROP USER D
BSNMP CASCAD
E; or run $ORACLE_HOME/rdbms/admincatnsnmp.sql/
change username/password is minimum.
For high security should remove the D
BSNMP binary from the $ORACLE_HOME/bin as this is SUID
.
Also change the D
BSNMP password in snmp_rw.ora file
žselect grantee
D
BA ROLEs should be ignored as they need these privileges.Oracle software permissions„attacker taking control of files that
Check OS file permissions in $ORACLE_HOME/bin and $ORACLE_HOME and should all be owned by ORACLE and group m
$ORACLE_HOME/bin set to 0755
and all other $ORACLE_HOME to 0750

Page 3
 391424375

cat /etc/passwdíOracle installation requires a temp directory. Should not use /tmp as permissions are open. Therefore set TMP
Secure the snmp_ro.ora and snmp_rw.ora file as part of the IA audit.encrypt data transferD
If data sent is sensitive then the c
http://oracleheva1.oracle.com/docs/cd/B19306_01/network.102/b14268/asointro.htmøSQL*PLUS encrypts passwords (which
If the client connections are made via web browser then SSL should be used which is part of OAS but can be implemented se
USE_CMAN=TRUE
Can also use Oracle names or Oracel Internet D
irectory preferably OID
._Architectural issue is complex and cannot presribe c
The secure way to configure the listener is with Admin Restrictions ON which means that the Listener configuration changes h
Please see this document for more detail on securing the Oracle Listener. http://www.integrigy.com/info/Integrigy_OracleD
B_L
It should be noted that some clustering software such as SUN Solaris v3.0 cannot restart the Listener automatically if it fails a
1Audit the listener and sqlnet files on the server Availability / backup / Recovery
At least put in place the previous securing D
BSNMP recommendations and preferably do not use at all. SQL*PLUS command
• iSQL*Plus requires a working http server on the same machine as the database which is a security weakness. D
isable iSQL
edit the oracle_apache.conf and comment out the line which includes isqlplus.conf by using a #should not be negotiable.remo
They can be granted back when needed.-revoke execute on dbms_debug from devaccount;
It is advisable to pay for an advanced scanner like NGS SQuirreL for Oracle which has the updates contained within it and aut
Use Opatch to apply the patch and then check the state of the applied package that should have been changed by using dbm
Please note that earlier versions of Opatch are quite unreliable and allow patch information to be accessed by any OS user.ýT
ALTER USER ACCOUNT UNLOCK;
WKSYS and D
BSNMP are two of the most commonly used default accounts as they have strong privileges and are often over
The default profile is often used and should have password management features enabled using:
ALTER PROFILE D
EFAULT
LIMIT FAILED
_LOGIN_ATTEMPTS 5
PASSWORD
_LIFE_TIME 40
PASSWORD
_REUSE_MAX 10
PASSWORD
_REUSE__TIME UNLIMITED

PASSWORD
_LOCK_TIME 1
PASSWORD
_GRACE_TIME 3;ðdefault accounts may not have password management features enabled as the profile has to
see the securing D
BSNMP section.secure or remove D
BSNMP!
Oracle comes installed with many default accounts which are
select 'SYSTEM'
from dba_sys_privs
where grantee='PUBLIC'
union
select 'OBJECT'
from dba_tab_privs
where grantee='PUBLIC'
union
select 'COLUMN'
from dba_col_privs
where grantee='PUBLIC'
union
select 'ROLE'
from dba_role_privs
where grantee='PUBLIC';
úThis will take a long time and needs to be broken down into stages. The main amount of results will be the object privs form d
These profile parameters should be set up and different values set in different profiles for each security level of user. Parame
CPU_PER_SESSION
PRIVATE_SGA
SESSIONS_PER_USER
CONNECT_TIME

Page 4
 391424375

ID
LE_TIMEagreeing how long a session can be left idle before it is disconnected is the main issue here and it depends on the
SITEMIND
ER061354246A45BBABSI_INFORMTN_SCHEMA84B8CBCA4D
477FA3SLID
ESLID
EPWFD
FE8B904875643D
SP
instance and remove or delete the dat files related to otrace.
process.dat
collect.dat
regid.dat
Once these are removed/deleted you should restart your
instances and listener and otrace will be disabled. qotrace has known security issues and also performance issues as the .da
select name
These permissions should be 600 if ORACLE is to run the db.^If a different user from ORACLE is used but in the same group
Select * from dba_sys_privs where grantee='CONNECT';

GRANTEE PRIVILEGE
------------------------------ ----------------------
CONNECT CREATE VIEW
CONNECT CREATE TABLE
CONNECT ALTER SESSION
CONNECT CREATE CLUSTER
CONNECT CREATE SESSION
CONNECT CREATE SYNONYM
CONNECT CREATE SEQUENCE
CONNECT < CREATE D
ATABASE LINKxto identify those with CONNECT you can use this query.
select grantee from dba_role_privs where granted_role='CONNECT';
&Add passwords to administrative roles
discretionary
Remote Archive Logging is a key recommendation for good Oracle backup and recovery.
Schedule both hot backups which take the data and Cold backups which will take all data and configuration for a complete reb
Rotate and renew backup media incase of worn tapes.On line redo logs mirroring_The Oracle database cannot work normally
Ensure archive logs are written to backup and are purged and protected.4D
estroy old disks that have contained database dat
http://www.dbaoncall.net/references/ref_backup_strategy.html !
wrap PL/SQL code in the database;Apply latest patch and kee
Also revoke access to UTL_FILE and only grant to those db accounts that require the OS access.-Check dbms_backup_resto
revoke access as needed.Check D
IRECTORY objects„Java can be used to access the OS from Oracle so Java permissions s
set in init.ora›dbms_job can be used to run scheduled jobs at a certain time which is useful for an attacker so that there scripts
Revoke execute privilege'REVOKE EXECUTE ON D
BMS_JOB FROM PUBLIC;wThe OWA_UTIL PL/SQL application expose
accessible anonymously via the web.)revoke execute on owa_util from public;

²should be no discussion on this but users may need to kill their own sessions therefore use kill command on UNIX or orakill.e
Need to use the Password management features of Oracle to allow constant checking for compliancy.
Run a password cracker on the checksums for the passwords from sys.user$ to see if they are strong. NGS SQuirreL for Orac
It is also common for some users to set the password to be the same as the user which is covered by SQuirreLzusers such as
from dba_objects
where owner<>'SYS'
and ((object_name like '%USER%'
and object_name not like 'USER_%') or object_name like '%USR%'
or object_name like '%PASSWD
%'
or object_name like '%PWD
%'
or object_name like '%PASS%')
and object_type in('VIEW'
union

Page 5
 391424375

select table_name object

column_name type
owner owner
from dba_tab_columns
where owner<>'SYS'
and (column_name like '%USER%'
or column_name like '%USR%'
or column_name like '%PASSWD
%'
or column_name like '%PWD
%'
or column_name like '%PASS%')
/
@no problem running the query but problem when passwords are found so have to prepare for this. It may be the case that th
If weak passwords are found this way then need to secure the tables that contain the passwords and talk the application provi
ALTER USER ORD
SYS D
EFAULT TABLESPACE tools TEMPORARY TABLESPACE temp;D
REVOKE D
D
L privileges that the
Given this fact they are susceptible to being cracked.
An example of this problem is shown in this paper by Josh Wright
https://www.sans.org/info/911/4A3BA55E08595C81Often neglectedn the OUTLN account has EXECUTE ANY PROCED
URE
OWA_PUBLIC0D
9EC1D
1F2A37657OWF_MGR7OWF_MGR is the schema owner of Oracle Workflow Manager.3CBED
37697
TD
OS_ICSAP7C0900F751723768TECTECTEC9699CFD
34358A7A7TESTPASSWD
26ED
9D
D
4450D
D
33C7A0F2B316C212
THINSAMPLE? which is generally not used in many organizations. If not used you might want to lock it.TRAVEL97FD
0AE6D
F
VIF_D
EVELOPERVIF_D
EV_PWD
9A7D
CB0C1D
84C488VIRUSER404B03707BF5CEA3VPD
_AD
MINAKF7D
98S2571A70900
SYSTEMPASS4861C2264FB17936970BAA5B81930A40MANAG3R135176FFB5BA07C9ORACL3E4519FCD
3A5654460RA
D
EV2000_D
EMOS18A0C8BD
6B13BEE2>D
EV2000_D
EMOS is a demonstration account for Oracle D
eveloper.D
IANEPASSW
OPENSPIRITD
664AAB21CE86FD
2OPI1BF23812A0AEED
A0[OPI is a schema account from Oracle Applications. D
efault it ha
ORAD
BAPASSC37E732953A8ABD
BcORAD
BA is a D
BA account of Computer and Information Services from the University o
ORASSO_PUBLICC6EED
68A8F75F5D
3@ORASSO_PUBLIC is a public account for Oracle9iAS Single Sign-On.ORASTAT6
D
BMS_D
ATAPUMPD
BMS_D
D
LD
BMS_D
EFER_REPCATD
BMS_EXPORT_EXTENSIOND
BMS_FGAD
BMS_INTERNAL_REP
D
BMS_METAD
ATAD
BMS_LOGMNR_SESSIOND
BMS_REPCATD
BMS_REPCAT_AD
MIND
BMS_REPUTILD
BMS_SNAPSHO
D
BMS_STATSD
BMS_SYSTEM
D
BMS_XRWMVD
BUPGRAD
EKUPF$FILEKUPW$WORKERLTUTILOUTLN_PKGOWA_OPT_LOCKWK_ACLWK_AD
MD
BMS
D
BMS_XD
BZ0D
BMS_XMLSCHEMAD
BMS_XMLSCHEMA_INTCAlert 56
D
bnsmp is SUID
root and should either be removed or changed.chmod -s binaryname6Check environment variables for usern
find $ORACLE_HOME -name "*" -print | while read filename
do
echo "filename "$filename >>user.lis
egrep -I 'connect|sqlplus' $filename >> user.lis2>/dev/null¿It may be the case that an automated script with a password is req
OD
S_SERVERC6E799A949471F57ROD
S_SERVER is an administrative account for of Oracle Internet D
irectory metadata.O
The functionality is owned by CTXSYS which unfortunately also has PUBLIC execute on many of the packages and tables.ZM
NEOTIX_SYS05BFA7FF86D
6EB32NNEULNNEULPASS4782D
68D
42792139`
NNEUL is an account of Computer and Inform
NOMEUTENTE8A43574EFB1C71C7NOME_UTILIZAD
ORSENHA71452E4797D
F917BNUME_UTILIZATORPAROL73A3AC3
OAS_PUBLICA8116D
B6E84FA95D
GOAS_PUBLIC is the schema account of older versions of Oracle Webserver.9300C0977
MD
D
EMO_MGR2E175141BEE66FF6CMD
D
EMO_MGR is an administration account for to Oracle Metadata API.MD
SYS7297
If real data does get in to the development db then the top priority is to make sure that the D
B account usenames and passwo
from dba_segments
where tablespace_name='appowner';¬
As described previously objects not owned the tablespaces schema owner can pose a
Metalink notes 136480.1 and 1009091.6
Should restrict use of the PS command using OS permissions.˜who gets permissions to ps is the question here. Root has it an
Need to edit the tnsnames.ora file and port forward using putty
# TNSNAMES.ORA

Page 6
 391424375

C:\oracle\ora90\network\admin\tnsnames.ora
PLSQL =
(D
ESCRIPTION =
(AD
D
RESS-LIST =
(AD
D
RESS = (PROTOCOL = TCP) (HOST = localhost) (PORT = 7774)))
(CONNECT-D
ATA =
(SERVER = D
ED
ICATED
)
(SERVICE-NAME = plsql)
)
)

then:
ssh -L 7774:venus:1521 venusSecure network communications^An attacker can force a second non-encrypted login which is
set D
BLINK_ENCRYPT_LOGIN to TRUEgedit the text file init.ora to include the statement ORA_ENCRYPT_LOGIN=TRUE;
D
BLINK_ENCRYPT_LOGIN =TRUEJD
BC thin minimum permissions«This process necessetates the archiving of log files an
audit the presence of trace files:
select name
Then ls -al that directory to see who can read them.
Also check for trace files outside of the usual destination using
find $ORACLE_HOME -name "*.trc" -exec ls -al {} \; - print±RD
A files contain a lot of internal connection details and are uploa
The local copy of the RD
A files should be deleted after they have been sent.OOracle raw devices should have minimum perm
iSQLPlus 10g Oracle i*SQLPlus Oracle i*SQLPlus RMI Port )Oracle Notification Service request port 'Oracle Notification Serv
There are many default Oracle ports:

Please note that fat thumbed passwords may appear in the sqlnet.log from failed SQL*PLUS connections.:Oracle HTTP Serve
Oracle Names !
Oracle Connection Manager (CMAN) Oracle Connection Manager Oracle JD
BC for Rdb Thin Server Oracle R
BRUKERNAVNPASSWORD
652C49CD
F955F83A9iR2 documenationBSCEC481FD
7D
CE6366A[BSC is a schema account fr
STRAT_USERSTRAT_PASSWD
AEBED
BB4EFB5225BSWPROEUsually it is not a good idea to have anonymous access to a
Set by valuesAPEED
09A552944B6AD
(AP is an account for Oracle Applications specifically Account Payable.APPLMGRCB56
APPLSYSPUBD
5D
B40BB03EA1270PUBD
2E3EF40EE87221EFND
PUB78194639B5C3D
F9FAPPLYSYSPUBOAPPLYSYSP
Will also need to test that the low privileged accounts that should not see the usernames cannot actually see them by logging
BRIO_AD
MINEB50644BE27D
F70B0BRIO_AD
MIN is an account of a 3rd party product.
BRUGERNAVNAD
GANGSKOD
E2F11631B6B4E0B6F9iR2 documentation[GMP is a schema account from Oracle Application

!
"#$%&'()*+
AD
MINISTRATORF9ED
601D
936158BD
OAD
MINISTRATOR is a commonly used name for management accounts for applica
CA HarvestHXC4CEA0BF02214D
A55[HXC is a schema account from Oracle Applications. D
efault it has several CREATE priv
http://www.ngssoftware.com/squirrelora.htmÍThe permission of select any table is required by the D
BSNMP account for the in
SQL> alter user sys identified by values 'no-decrypt';

User altered.

SQL> select password from dba_users where username = 'SYS';

PASSWORD

------------------------------
no-decrypt3The D
BA role and SYS user will have this privilege.Îcreate any directory does not have a non ANY version but mo

Çutl_tcp can be used to connect from an Oracle database over the network to another database and is a common way for a h
(select object_name from dba_objects where owner ='SYS' and object_type='PACKAGE')intersect

Page 7
 391424375

(select table_name from dba_tab_privs where grantee='PUBLIC' and privilege='EXECUTE');

”Some packages need PUBLIC execute but many should not. Many recent PLSQL injection attacks are targetted at SYS own
plsql_native_c_compiler
plsql_native_library_dir
plsql_native_library_subdir_count
plsql_native_linker
plsql_native_make_file_name[FII is a schema account from Oracle Applications. D
efault it has several CREATE privileges.FIN
It is advised when developing internal packages that auth_id current_users is used instead of definers rights to make the risk
SELECT * FROM dba_directories;
Un needed ones can dropped
D
ROP D
IRECTORY directory_name
ÖD
IRECTORIES from an Oracle point of view are links to the OS and should be monitored as part of an audit. D
irectories ten
Networking'Prevent remote dba access on sql*net v1Audit the listener.ora fileEnable shared socketswin;Use a personal firewa
set in init.ora
LSELECT value FROM v$parameter where name ='remote_os_roles';
set in init.oraQSELECT * FROM v$parameter ORD
ER BY name;
and compare with the init<SID
>.ora file
The init.ora file is a flat file which may not actually be loaded into the memory the database so it is worth checking the two. Th
set in init.ora$Audit exempt access policy privilege‚exempt access policy privilege can be used to circumvent fine-grained sec
from dba_sys_privs
where privilege = 'EXEMPT ACCESS POLICY';
7SERIALIZABLE set to FALSE and ROW LOCKING set to ALWAYS
set in init.oraGSELECT * FROM v$parameter where name ='sql92_security';
set in init.ora%Check max_enabled_roles less than 30HSet up naming conventions for schema owners and administrators an
select pin.ksppinm called
pcv.ksppstvl itsvalue
from sys.x$ksppi pin
sys.x$ksppcv pcv
where pin.inst_id=userenv('Instance')
and pcv.inst_id=userenv('Instance')
and pin.indx=pcv.indx
and translate(pin.ksppinm
Alternatively an OS level checksum of the init<SID
>.ora file would also verify more easily the state of the parameter file. Try to
select tablespace_name from dba_data_files where autoextensible='YES';An applications tablespace should not have objects
(select name from sys.user$)minus
(select username from dba_ts_quotas);#Check for triggers on others tables™It is possible to steal data from another schema
select owner
select name
D
o not set up links as the D
BA user as this user can masquerade as any other and has too many privileges for a link.

Set D
BLINK_ENCRYPT_LOGIN to TRUE.* listener Password and Admin restrictions ßOracle networks on 1521 by default at
An alternative to this is to use a Proxy firewall such as Checkpoint NG1 which keeps state of current connections and can the
The Listener should not be connected to over the Internet.Set a password on the Listener and set Admin Restrictions to ON.
To encrypt the listener password change it through lsnrctl:
lsnrctl>change_password
password changed
lsnrctl>save_config

Then restart the listener.

Page 8
 391424375

USE SSH TO THE OS TO AD
MIN THE LISTENER.Oracle ports scan‰Parameter value changes can be missed and have a l
select distinct grantee
(select role from dba_roles));ØIt is generally preferable to assign privileges to ROLES and ROLES to users rather than privileg
from dba_sys_privs
where privilege='CREATE LIBRARY'
$none needed as previously addressed.&Check for EXTERNAL users and also D
BAµselect username
from dba_users
where password='EXTERNAL';

select username
from dba_role_privs
where username=grantee
and granted_role='D
BA'
and password='EXTERNAL';

3External users have already been addressed in the OS section but an extra check is to see which users have the password
EXTERNAL users should have absolutely minimal privileges as it is possible to spoof their logins. No SYSD
BA or SYSOPER u
0D
o not use external accounts for batch processes1Consider password retrieval and use in schedulers/Enable batch databas
(select count(*) from system_privilege_map)intersect
(select count(*) from dba_sys_privs group by grantee);
Check for number of privs in case too many.
select count(*) from system_privilege_map;
select count(*)
from dba_sys_privs
group by grantee;ANY privileges@ANY privileges are to be avoided as it is not accurate to need._select grantee
from dba_sys_privs
where privilege like '%ANY%';
revoke where possiblenone needed should be enforced.' WITH AD
MIN or "WITH GRANT" privileges‹ WITH AD
MIN or "WITH
granted_role
from dba_role_privs
where admin_option='YES'
union
select grantee
privilege
from dba_sys_privs
where admin_option='YES';
D
o the same query 'WITH GRANT';˜select grantee
from dba_sys_privs
where grantee not in ('SYSTEM'
and not exists (select 'A' from dba_roles where role=grantee)system privileges grantedfsystem privileges tend to be more pow
If it is being used then can just lock CTXSYS
ALTER USER CTXSYS ACCOUNT LOCK;
Revoke all access to CTXSYS packages from PUBLIC.
¬
If os_authent_prefix is set to (null string) then a user can either logon externally or internally not both. External is insecure a
set in init.ora$Non sys objects in system tablespace_Check for non sys owned objects in the system tablespace that are not
from dba_segments
where tablespace_name='SYSTEM'
and owner<>'SYS';œThere will probably be SYSTEM and OUTLN objects which are default with Oracle but this check is looki

Page 9
 391424375

Revoke from accounts that do not need it

revoke dba from accountname;µCREATE ROLE dba_role ID
ENTIFIED
BY "S0^Sorry"; or
alter role dba identified by "S0^Sorry";
See which roles are passworded.
select *
from dba_roles
where password_required='NO';
In high security environments powerul roles such as D
BA should be passworded. Please note that a passworded role granted
from dba_sys_privs
where privilege = 'BECOME USER';CREATE ANY D
IRECTORY privilege•ExtProc enables external access to C libraries on th
http://www.ngssoftware.com/advisories/ora-extproc.txt
http://www.oracle.com/technology/deploy/security/pdf/plsextproc_alert.pdf
http://www.oracle.com/technology/deploy/security/pdf/2003alert57.pdf
Please see the Shellcoders handbook page 406-10 for more detail of the buffer overflow.
Also see D
atabase Hackers Handbook page 89
Also see security the Listener further on in this guide.Check access to catalog rolesoOnly D
BA should have access to the cata
EXECUTE_CATALOG_ROLE
'D
ELETE_CATALOG_ROLE
select grantee
from dba_role_privs
where granted_role in ('SELECT_CATALOG_ROLE'
revoke as needed.none needed.Žselect grantee
from dba_tab_privs
where table_name in ('D
BA_ROLES'
'D
BA_ROLE_PRIVS'
Check access to dba role viewsViews pre-fixed by the lettes D
BA are for the use of the D
BA and should not be viewable by n
SELECT * FROM v$parameter ORD
ER BY name;
This query is specifically for archivelog mode and whether it is switched on.
select log_mode from v$database;

developer privileges present in the development database should be tested to make sure they are not in production.
Also check for db links between the two as described previously
Also make sure that test data in development is not real data but does closely model it.
< © In order to set a secure password in
oracle it is recommended to use a quoted password which allows for ctrl UNICOD
E
characters to be used in each of the 30 places.
ALTER USER PAUL ID
ENTIFIED
BY "passwordincludingnumbersandctrlchars";"
This makes the password very difficult indeed to crack."
As well as making the pasword secure it is possible to set up alias' for the accounts so that users actual username is never kn
select * from dba_tab_privs where grantee ='PUBLIC' and table_name like 'STATS$%';
revoke as necessary secure or remove extprocäTo remove Extproc:
-Remove the entries from the listener.ora file
-Remove entries from any tnsnames.ora
-D
elete the extproc binary
-Revoke create / alter (any) library privileges
-Revoke create / alter procedure privileges
To secure Extproc:
-Create a separate user for the extproc listener
-Remove extproc entries from listener.ora and tnsnames.ora

Page 10
 391424375

- Create a new seperate listener for extproc

-use valid node checking on the new extproc listener and restrict to IPC protocol only.`
For D
BA here is seperate Extproc listen

LISTENER EXT =
(D
ESCRIPTION LIST =
(D
ESCRIPTION =
(AD
D
RESS-LIST =
(AD
D
RESS = (PROTOCOL = IPC) (KEY= EXTPROC)))))
SID
-LIST EXT =
(SID
-LIST =
(SID
-D
ESC =
(SID
-NAME = PLsExtPr0c)
(ORACLE-HOME = /export/home/uOl/app/oracle/product/9.0.1)
(PROGRAM = extproc)
)
)This SQL will identify VIEWs which allow base table to be edited.
select grantee
from dba_tab_privs
where exists (select 'x'
from dba_views
where view_name=table_name)
and privilege<>'SELECT'
union
select grantee
from dba_col_privs
where exists (select 'x'
from dba_views
where view_name=table_name)
and privilege<>'SELECT'
/

Also it is possible to bypass Oracle object security on underlying tables from a view as below(from D
avid).
SQL> connect / as sysdba
Connected.
SQL> create table ttt (n number
key(n));
Table created.
SQL> insert into ttt (n
1 row created.
SQL> grant select on ttt to scott;

SQL> connect scott/tiger

Connected.
SQL> create or replace view vvv as select a.n
sys.ttt b on a.n = b.n;
View created.
SQL> select * from vvv;
N TEXT

Page 11
 391424375

---------- ---------
1 abc
SQL> insert into vvv (n
1 row created./LOCK SYS and SYSTEM and create new D
BA accountsŒ

This measure when combined with a less obviously
This can be used prevent D
BA's reading critical data as well.D
isable unneeded TCP ports.>remove the line
dispatcher=(PROTOCOL=TCP) (SERVICE=orat92XD
B)[ASF is a schema account from Oracle Applications. D
efault it has sev
(select grantee from dba_tab_privs where table_name
in('USER$'
UNION
(select grantee from dba_sys_privs where privilege in('SELECT ANY
D
ICTIONARY'
UNION
(select grantee from dba_role_privs where granted_role
in('D
BA'
ORD
ER BY GRANTEE;
This query includes users who have SELECT ANY TABLE which is a privilege that should be revoked.Êobject creation should
from dba_sys_privs
where grantee='SCOTT'
union
select table_name
from dba_tab_privs
where grantee='SCOTT'
union
select table_name
from dba_col_privs
where grantee='SCOTT'
union
select 'ROLE'
from dba_role_privs
where grantee='SCOTT';$time intensive. If time pressured and not v.high security then better to approach from the direction o
The other major issue with auditing is the problem with performance as the more that is audited the more resources are taken
Please see Oracle Privacy Auditing by Arup Nanda for more detail on Auditing on Oracle.ÎThere can be much discussion on A
The intelligent agent which functions like an Oracle version of SNMP called D
BSNMP which uses the D
BSNMP account with d
The port number profile of that server should be recorded so that changes can be recognised. Remove needed services/ports
Ì 0n(Òç-'O0¿ÿ 
X2˜B6‚
¿ÿ 
Å
8
u¶:öí<-“?Ó™øA8ÿ 
ÿ 
FG¿ÿ 
ÞGuïJ/ “N°€òP›V¸
4`
Q™Èfåqmj¿ÿ 
öpï„Œ

ËrızªD
‡=¿ÿ 
 ˆË ÿ 
žÔQ«Û¿ÿ 
໑„Œ

PÅ
¿ÿ 
eÏòÿ 
ÿ 
´ÑA¿ÿ 
ÎÙ[
u•ã"Éì2¿ÿ 
èîQõó^
¿ÿ 
>šü„¢w›5Vžâ ¿ÿ 
§Úø§¶¿ÿ 
Ô¨’±²KCºÝÀµ¿ÿ 
mÂ
‘€L¿ÿ 
§Ð"„@„‘€Á
\ÿ 
ôôô

„¨J Hˆ ˆ¿ÿ 
ž°Kÿ 
ôôôW’4PBðQŸ LpP+Å
Ü™ÞPC€ÿ 
ø‚àÐ)Jüÿ 
ôôôÿ 
ôôôÿ 
ôôôÿ 
ôôô¿ÿ 
¢üÿ 
ôôônal users who have ALL PRIVILEGES
Å
=ÌÈÀ<RKÍ[íkS|ÿ 
Œ

Çe®


M¾Ï5ß·ï7ø
dü©ñÒMbP?_*+‚€%ðÁ
ƒ„¡"d
}*}U'}?}ª<}*6}*}€
}€}* indexR†À%ð€$€ ’@ð€à ’à ’Ãà ’€À’ðÿ 
 àÿ 

ÐTHƒÀ“àÐTXƒ
“"„ðà

Page 12
 391424375

़ðÃHƒÐÀ“„À“À ðð €àÀðõàŠÀð0”Ѐðè”@ý
%Õý
%Öý
%Úý
%ý
%Ûý
%×ý
%Øý
%Ùý
$Ðý
$Þ
ý
Ïý
pý
qý
rý
Z~
ð?ý
Ý
ý
Ý
ý
Ñý
àý
ãý
åý
ä~
ð?ý
Ý
ý
Ý
ý
Òý
áý
Üý
ý
Ý~
@ý
Ý
ý
Ý
ý
Óý
ß
ý
ßý
Þý
â~
@ý

Page 13
 391424375

à
ý
Ý
ý
Ôý
æý
èý
çý
é~
@ý
Ý
ý
Ý
ý
Õý
©ý
Ôý
ný
Õ~
ð?ý
âý
Wý
Yý
Xý
[~
ð?ý
à
ý
Ý
ý
ãý
á
ý
½ý
½ý
½~
ð?ý
à
ý
Ý
ý

äý

\ý

^ý

]ý

Page 14
 391424375

í~

ð?ý

â
ý

Ý
ý
åý
_ý
sý
`
ý
í~
ð?ý
à
ý
Ý
ý
æý
ã
ý
½ý
½ý
½~
ð?ý
â
ý
Ý
ý

çý

>ý

?ý

<ý

=~

ð?ý

Ý
ý

Ý
ý

Page 15
 391424375

èý
Eý
½ý
½ý
½~
ð?ý
à
ý
Ý
ý
éý
D
ý
Aý
@ý
í~
ð?ý
à
ý
Ý
ý
êý
Fý
Cý
Bý
í~
@ý
â
ý
Ý
ý
ëý
ä
ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
ìý
Ký
Jý
Iý
ö~
@ý
Ý
ý

Page 16
 391424375

Ý
ý
íý
÷
ý
Çý
Æý
í~
@ý
Ý
ý
Ý
ý
îý
å
ý
Èý
Éý
Ê~
ð?ý
Ý
ý
Ý
ý
ïý
Ëý
Ìý

-~
@ý
Ý
ý
Ý
ý
ðý
æ
ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
ñý
ç
ý
½ý
½ý

Page 17
 391424375

½~
@ý
Ý
ý
Ý
ý
òý
è
ý
/ý
0ý
í~
@ý
Ý
ý
Ý
ý
óý
é
ý
1ý
2ý
3~
ð?ý
à
ý
Ý
ý
ôý
4ý
ý
!
ý
"~
ð?ý
à
ý
Ý
ý
õý
ê
ý
½ý
½ý
½~
@ý
à
ý
Ý
ý

Page 18
 391424375

öý
#ý
$ý
%ý
í~
@ý
à
ý
Ý
ý
÷
ý
'ý
*ý
&ý
ó~
@ý
Ý
ý
Ý
ý
øý
)ý
(ý
*ý
í~
@ý
Ý
ý
Ý
ý
ùý
ë
ý
½ý
½ý
½~
ð?ý
Ý
ý
Ý
×D
lppppppTppppppppppppppppppppppp ð%!
Ð$€"ð ’@#Ѐ$Ð ’%° ’Ã&ð ’'àÀ’Ã(Ðÿ 
)°ÿ 
*ÐÐTHƒ+ð“
0़1ÐÃHƒ2ÀÀ“„3ðÀ“4°5ð6`
7 8à€9à:ð€$;Ðõ<°ŠÀ= 0”>à€?àè”@ý
úý
ì
ý
½ý
½ý
½~
ð?ý

Page 19
 391424375

Ý
ý
Ý
ý
!
ûý
!
+ý
!
1ý
!
2ý
!
í~
!
ð?ý
!
Ý
ý
!
Ý
ý
üý
í
~
@ý
à
ý
Ý
ý
#ýý
#3ý
#4ý
#5ý
#í~
#@ý
#à
ý
#Ý
ý
$þý
$6ý
$7ý
$8ý
$9~
$@ý
$Ý
ý
$Ý
ý
%ÿ 
ý
%î
ý
%<ý
%:ý
%;~
%@ý

Page 20
 391424375

%Ý
ý
%Ý
ý
&ý
&ï
ý
&½ý
&½ý
&½~
&@ý
&à
ý
&Ý
ý
'ý
'ð
ý
'½ý
'½ý
'½~
'@ý
'Ý
ý
'Ý
ý
(ý
(=ý
(>ý
(?ý
(í~
(@ý
(Ý
ý
(Ý
ý
)ý
)@ý
)Aý
)âý
)ã~
)@ý
)Ý
ý
)Ý
ý
*ý
*ñ
ý

Page 21
 391424375

*äý
*Íý
*Î~
*@ý
*Ý
ý
*Ý
ý
+ý
+ò
ý
+½ý
+½ý
+½~
+@ý
+à
ý
+Ý
ý

ý
-}ý
-ó
ý
-Ðý
-Ñý
-í~
-@ý
-Ý
ý
-Ý
ý
.Öý
.êý
.ìý
.ëý
.í~
.@ý
.Ý
ý
.Ý

Page 22
 391424375

ý
/×ý
/Gý
/Hý
/.ý
/î~
/@ý
/Ý
ý
/Ý
ý
0Øý
0
ý
0½ý
0½ý
0½~
0@ý
0Ý
ý
0Ý
ý
1Ùý
1Ž
ý
1ïý
1oý
1~
1ð?ý
1Ý
ý
1Ý
ý
2Úý
2
ý
2£ý
2ý
2¤~
2ð?ý
2Ý
ý
2Ý
ý
3Ûý
3
ý
3½ý
3½ý

Page 23
 391424375

3½~
3ð?ý
3Ý
ý
3Ý
ý
4Üý
4Rý
4¦ý
4¥ý
4§~
4@ý
4Ý
ý
4Ý
ý
5Ýý
5Qý
5½ý
5½ý
5½~
5@ý
5Ý
ý
5Ý
ý
6Þý
6Pý
6ý
6ý
6í~
6@ý
6Ý
ý
6‘
ý
7ßý
7ý
7ðý
7ý
7O~
7ð?ý
7Ý
ý
7‘
ý
8àý
8’
~

Page 24
 391424375

8@ý
8Ý
ý
8Ý
ý
9áý
9Sý
9Uý
9Tý
9V~
9ð?ý
9â
ý
9Ý
ý
:$~ý
:$“
ý
;ý
;”
ý
;Òý
;Óý
;í~
;@ý
;Ý
ý
;Ý
ý
<€ý
<•
ý
<Ôý
<Õý
<Ö~
<@ý
<Ý
ý
<Ý
ý
Err:501
Err:501
Err:501
Err:501
Err:501
Err:501
Err:501
ý
Err:501

Page 25
 391424375

ý
>‚ý
>Øý
>Û
ý
>Ü
ý
>í~
>@ý
>Ý
ý
>Ý
ý
?ƒý
?—
ý
?½ý
?½ý
?½~
?@ý
?Ý
ý
?–
×D
ØlppFpppppppppppppppppppppFppppp@€%Aà$€B`
 ’@Cð€D
ð ’E ’ÃFð ’GàÀ’ÃHÐÿ 
I°ÿ 
JðÐTHƒKà“LpÐTXƒMà “"„NðOà
Pð¤¼Q°ÃHƒRàÀ“„SàÀ“T Uð€$V°WÐX€YðZ $[ðõ\°ŠÀ]ð0”^€_àè”@ý
@„ý
@˜
ý
@ªý
@›ý
@¨~
@ð?ý
@Ý
ý
@Ý
ý
A…ý
Až
ý
A½ý
A½ý
A½~
Að?ý
AÝ
ý
AÝ
ý
B‡ý
B™

Page 26
 391424375

ý
Bžý
Bý
BŸ~
Bð?ý
BÝ
ý
BÝ
ý
Cˆý
Cš
ý
C½ý
C½ý
C½~
C@ý
CÝ
ý
C›
ý
D
‰ý
D
œ
ý
D
½ý
D
½ý
D
½~
D
@ý
D
Ý
ý
D
Ý
ý
EŠý
ELý
E/ý
E0ý
E+~
Eð?ý
EÝ
ý
EÝ
ý
F‹ý
Fý
F½ý
F½ý
F½~
Fð?ý
FÝ
ý

Page 27
 391424375

FÝ
ý
GŒ

ý
G
ý
G½ý
G½ý
G½~
G@ý
GÝ
ý
GÝ
ý
Hý
H‹ý
HŒ

ý
HPý
Hí~
H@ý
HÝ
ý
HÝ
ý
IŽý
I7ý
IQý
IRý
Ií~
I@ý
IÝ
ý
IÝ
ý
J†ý
JŸ
ý
J½ý
J½ý
J½~
Jð?ý
JÝ
ý
JÝ
ý
Ký
K
ý
Kôý
Kôý

Page 28
 391424375

Kô~
K@ý
KÝ
ý
KÝ
ý
Lý
L¡
ý
L^ý
L8
ý
LÈ~
L@ý
LÝ
ý
LÝ
ý
M‘ý
M¢
ý
Môý
Môý
Mô~
M@ý
MÝ
ý
MÝ
ý
N’ý
N£
ý
N½ý
N½ý
N½~
N@ý
NÝ
ý
NÝ
ý
O“ý
O¤
ý
O½ý
O½ý
O½~
O@ý
OÝ
ý

Page 29
 391424375

OÝ
ý
P®


ý
P¥
ý
P½ý
P½ý
P½~
P@ý
PÝ
ý
P‘
ý
Q¯ý
QMý
QNý
Q-ý
Q.~
Q@ý
QÝ
ý
QÝ
ý
R°ý
R¦
ý
Rý
Rý
Rí~
R@ý
RÝ
ý
RÝ
ý
S±ý
S§
ý
S½ý
S½ý
S½~
S@ý
SÝ
ý
SÝ
ý
T²ý
Tý
Tý
Tý

Page 30
 391424375

T~
T@ý
TÝ
ý
TÝ
ý
U$³ý
U$¨
ý
V´ý
Vý
Vý
V~
V@ý
VÝ
ý
VÝ
ý
Wµý
Wý
W
ý
Wý
Wí~
W@ý
WÝ
ý
WÝ
ý
X¶ý
X©
ý
X
ý
Xšý
X~
X@ý
XÝ
ý
X–
ý
Y·ý
Yª
ý
Y½ý
Y½ý
Y½~
Y@ý
YÝ

Page 31
 391424375

ý
Y–
ý
Z¸ý
Z›ý
Z}ý
Z
ý
Zí~
Z@ý
ZÝ
ý
Z–
ý
[¹ý
[«
ý
[½ý
[½ý
[½~
[@ý
[Ý
ý
[¬

ý
\Ùý
\Æý
\#ý
\$ý
\í~
\@ý
\Ý
ý
\Ý
ý
]Úý
]
ý
]½ý
]½ý
]½~
]@ý
]Ý
ý
]Ý
ý
^çý
^<
ý

Page 32
 391424375

^-
ý
^=
ý
^>
~
^ð?ý
^Ý
ý
^–
ý
_èý
_®



ý
_½ý
_½ý
_½~
_@ý
_Ý
ý
_¯
×D
lpppppppppppppppppppppbpppppppp`
 %a°$€bð ’@cð€dð ’eð ’Ãf ’gðÀ’Ãhðÿ 
iðÿ 
jðÐTHƒkð“làÐTXƒmÐ “"„nðoà
pФ¼qàÃHƒrÀÀ“„sÀÀ“tàuà$vÀwàxà€yÀzÐ${€õ|ÀŠÀ}`
0”~ð€ Àè”@ý
`
éý
`
.
ý
`
/
ý
`
0
ý
`
1
~
`
@ý
`
Ý
ý
`
Ý
ý
aêý
a3
ý
a4
ý
a2
ý
a1
~
a@ý
aÝ
ý

Page 33
 391424375

aÝ
ý
b‚ƒ„…†‡ˆ‰Š‹Œ

Ž‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§¨©ª«¬
®


¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁ
ÂÃÄÆýÿ 
ÿ 
ÿ 
ÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàá
b°
ý
b½ý
b½ý
b½~
b@ý
bÝ
ý
bÝ
ý
cìý
c±
ý
c½ý
c½ý
c½~
c@ý
cÝ
ý
cÝ
ý
díý
d²
ý
d½ý
d½ý
d½~
d@ý
dÝ
ý
dÝ
ý
eîý
e³
ý
e½ý
e½ý
e½~
e@ý
eÝ
ý
eÝ
ý
fïý
f5
ý

Page 34
 391424375

f'ý
f6
ý
f(~
f@ý
fÝ
ý
fÝ
ý
gúý
g´
ý
g½ý
g½ý
g½~
g@ý
gÝ
ý
gÝ
ý
hûý
hµ
ý
h½ý
h½ý
h½~
h@ý
hÝ
ý
hÝ
ý
iüý
i¶
ý
i½ý
i½ý
i½~
i@ý
iÝ
ý
iÝ
ý
jýý
j·
ý
j½ý
j½ý
j½~
j@ý

Page 35
 391424375

jÝ
ý
jÝ
ý
kþý
k¸
ý
k½ý
k½ý
k½~
k@ý
kÝ
ý
kÝ
ý
lÿ 
ý
l¸ý
lý
lý
l½~
l@ý
lÝ
ý
lÝ
ý
mý
m¹
ý
m
ý
m
~
m@ý
mÝ
ý
mÝ
ý
ný
nº
ý
n½ý
n½ý
n½~
n@ý
nÝ
ý
nÝ
ý
oðý

Page 36
 391424375

o»
ý
o½ý
o½ý
o½~
oð?ý
oÝ
ý
oÝ
ý
pñý
p¼
ý
p)ý
p¦ý
p1
~
p@ý
pÝ
ý
pÝ
ý
qòý
q\
ý
q¥ý
q§ý
q1
~
qð?ý
qÝ
ý
qÝ
ý
róý
r]
ý
r©ý
r¨ý
r1
~
r@ý
rÝ
ý
rÝ
ý
sôý
sªý
s«ý

Page 37
 391424375

s¬
ý
s1
~
s@ý
sÝ
ý
s‘
ý
tõý
t ý
t®


ý
t¯ý
t1
~
t@ý
tÝ
ý
t‘
ý
uöý
u^
ý
u½ý
u½ý
u½~
u@ý
uÝ
ý
uÝ
ý
v÷
ý
v°ý
v±ý
v²ý
v1
~
v@ý
vÝ
ý
v‘
ý
wøý
w_
ý
w³ý
w¶ý
w1
~
w@ý

Page 38
 391424375

wÝ
ý
wÝ
ý
xùý
xµý
x´ý
x·~
x@ý
xÝ
ý
xÝ
ý
yý
y
ý
y!

ý
y"
ý
y#
~
yð?ý
yÝ
ý
yÝ
ý
zý
z`

ý
z$
ý
z&
ý
z%
~
zð?ý
zÝ
ý
zÝ
ý
{ý
{
ý
{
ý
{
ý
{Í~

Page 39
 391424375

{ð?ý
{Ý
ý
{Ý
ý
|
ý
|
ý
|
ý
|
ý
|Î~
|ð?ý
|Ý
ý
|Ý
ý
}ý
}
ý
}
ý
}
ý
}Í~
}@ý
}Ý
ý
}Ý
ý
~ý
~a
ý
~½ý
~½ý
~½~
~@ý
~Ý
ý
~Ý
ý
ý

ý

ý


Page 40
 391424375

ý

~
ð?ý
Ý
ý
Ý
×D
dlpppppppppppppbppppppppppbpppppp€à%À$€‚À ’@ƒð€„ð ’…ð ’Æ𠒇ðÀ’ÈÐÿ 
‰Àÿ 
ŠàÐTHƒ‹P
“Œ

ðÐTXƒà “"„Žàð
़‘ÐÃHƒ’ÐÀ“„“ÐÀ“”Еp$–à—ИЀ™ðšð$›°õœàŠÀÐ0”žÐ€ŸÐè”@ý
€ý
€b
ý
€½ý
€½ý
€½~
€@ý
€Ý
ý
€Ý
ý
ý
óý
õý
ôý
ö~
@ý
Ý
ý
Ý
ý
‚ý
‚÷
ý
‚øý
‚ùý
‚
~
‚ð?ý
‚Ý
ý
‚Ý
ý
ƒý
ƒc
ý
ƒ½ý
ƒ½ý
ƒ½~
ƒ@ý

Page 41
 391424375

ƒÝ
ý
ƒÝ
ý
„ý
„d
ý
„½ý
„½ý
„½~
„@ý
„Ý
ý
„Ý
ý
…ý
…e
ý
…½ý
…½ý
…½~
…@ý
…Ý
ý
…Ý
ý
†ý
†f
ý
†½ý
†½ý
†½~
†@ý
†Ý
ý
†Ý
ý
‡ý
‡g
ý
‡½ý
‡½ý
‡½~
‡@ý
‡Ý
ý
‡Ý
ý
ˆý

Page 42
 391424375

ˆ)
ý
ˆ*
ý
ˆ+
ý
ˆ1
~
ˆ@ý
ˆÝ
ý
ˆÝ
ý
‰
ý
‰
ý
‰

ý
‰
ý
‰Í~
‰@ý
‰Ý
ý
‰h
ý
Šý
Š
ý
Š
ý
Š
ý
ŠÍ~
Š@ý
ŠÝ
ý
Ši
ý
‹ý
‹ûý
‹ýý
‹üý
‹ú~
‹@ý
‹Ý
ý

Page 43
 391424375

‹Ý
ý
Œ

ý
Œ

j
ý
Œ

½ý
Œ

½ý
Œ

½~
Œ

ð?ý
Œ

Ý
ý
Œ

Ý
ý
ý
k
ý
½ý
½ý
½~
ð?ý
Ý
ý
Ý
ý
Žý
Žl
ý
Ž½ý
Ž½ý
Ž½~
Ž@ý
ŽÝ
ý
ŽÝ
ý
ý
m
ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
ý
n
ý

Page 44
 391424375

½ý
½ý
½~
ð?ý
Ý
ý
Ý
ý
‘ºý
‘o
ý
‘
‘-ý
‘~
‘ð?ý
‘Ý
ý
‘–
ý
’»ý
’p
ý
’ý
’
ý
’~
’ð?ý
’Ý
ý
’q
ý
“¼ý
“r
ý
“ý
“ý
“~
“ð?ý
“Ý
ý
“q
ý
”½ý
”s
ý
”ý
”ý
”~
”ð?ý

Page 45
 391424375

”Ý
ý
”q
ý
•¾ý
•t
ý
•qý
•
ý
•~
•ð?ý
•Ý
ý
•Ý
ý
–¿ý
–u
ý
–½ý
–½ý
–½~
–@ý
–Ý
ý
–Ý
ý
—Àý
—v
ý
—0ý
—1ý
—~
—ð?ý
—Ý
ý
—›
ý
˜Á
ý
˜w
ý
˜2ý
˜3ý
˜~
˜ð?ý
˜Ý
ý
˜Ý
ý

Page 46
 391424375

™Âý
™x
ý
™½ý
™½ý
™½~
™ð?ý
™Ý
ý
™Ý
ý
šy
ý
šz
ý
š½ý
š½ý
š½~
š@ý
šÝ
ý
šÝ
ý
›{
ý
›ý
›sý
›rý
›.~
›@ý
›Ý
ý
›–
ý
œ|
ý
œ}
ý
œÊý
œ/ý
ϒ~
œ@ý
œÝ
ý
œÝ
ý
~
ý


Page 47
 391424375

ý
ý
ý
~
@ý
Ý
ý
Ý
ý
ž€
ý
ž
ý
žý
žý
ž~
žð?ý
žÝ
ý
ži
ý
Ÿ‚
ý
Ÿƒ
ý
Ÿý
Ÿý
ŸË~
Ÿ@ý
ŸÝ
ý
ŸÝ
×D
€lppppppppppppppppppppppppppppppp À%¡ð$€¢ð ’@£ð€¤à ’¥ ’æ ’§ðÀ’èðÿ 
©ðÿ 
ªðÐTHƒ«ð“¬
ÐTXƒð “"„®


à¯
°𤼱ÀÃHƒ²ÐÀ“„³àÀ“´àµÐ$¶@·ð¸ð€¹Ðº$»ôõ¼`
ŠÀ½°0”¾ð€¿àè”@ý
Ãý
5 ý
4 ý
6 ~
@ý
Ý
ý
Ý
ý
¡Äý
¡„
ý
¡½ý
¡½ý
¡½~

Page 48
 391424375

¡@ý
¡Ý
ý
¡Ý
ý
¢Å
ý
¢…
ý
¢½ý
¢½ý
¢½~
¢ð?ý
¢Ý
ý
¢Ý
ý
£Æý
£†
ý
£½ý
£½ý
£½~
£@ý
£Ý
ý
£Ý
ý
¤Çý
¤‡
ý
¤¿~
¤ð?ý
¤Ý
ý
¤Ý
ý
¥Èý
¥Íý
¥Ïý
¥Ðý
¥Î~
¥@ý
¥Ý
ý
¥Ý
ý
¦Éý
¦Ñý
¦(

Page 49
 391424375

ý
¦'
ý
¦Ò~
¦@ý
¦Ý
ý
¦Ý
ý
§Êý
§Óý
§«ý
§¬
ý
§~
§@ý
§Ý
ý
§Ý
ý
¨Ëý
¨ˆ
ý
¨½ý
¨½ý
¨½~
¨@ý
¨Ý
ý
¨–
ý
©Ìý
©‰
ý
©½ý
©½ý
©½~
©@ý
©Ý
ý
©–
ý
ªÍý
ªŠ
ý
ª½ý
ª½ý
ª½~
ª@ý
ªÝ

Page 50
 391424375

ý
ª–
ý
«Îý
«‹
ý
«½ý
«½ý
«½~
«@ý
«Ý
ý
«–
ý
¬
Ïý
¬
®


ý
¬
¯ý
¬
°ý
¬
±~
¬
@ý
¬
Ý
ý
¬
Ý
ý
Ðý
Œ


ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
®


Ñý
®


T
ý
®


²ý
®


³ý
®


í~
®


@ý
®


Ý
ý
®


Ý
ý
¯Òý
¯´ý
¯Îý

Page 51
 391424375

¯¼ý
¯í~
¯@ý
¯Ý
ý
¯Ý
ý
°Óý
°U
ý
°½ý
°½ý
°½~
°ð?ý
°Ý
ý
°V
ý
±Ôý
±‚ý
±¾ý
±½ý
±í~
±@ý
±Ý
ý
±Ý
ý
²Õý
²Àý
²Á
ý
²Âý
²í~
²@ý
²Ý
ý
²Ý
ý
³Öý
³W
ý
³½ý
³½ý
³½~
³@ý
³Ý
ý
³Ý
ý

Page 52
 391424375

´×ý
´¹ý
´½ý
´½ý
´½~
´@ý
´Ý
ý
´Ý
ý
µØý
µÃý
µÄý
µÅ
ý
µí~
µ@ý
µÝ
ý
µÝ
ý
¶Ûý
¶&ý
¶%ý
¶J
ý
¶É~
¶ð?ý
¶Ý
ý
¶Ý
ý
·Üý
·ºý
·½ý
·½ý
·½~
·ð?ý
·Ý
ý
·Ý
ý
¸Ýý
¸»ý
¸½ý
¸½ý
¸½~
¸ð?ý
¸Ý
ý

Page 53
 391424375

¸Ý
ý
¹Þý
¹tý
¹K
ý
¹L
ý
¹M
~
¹@ý
¹Ý
ý
¹Ý
ý
ºßý
ºN
ý
ºO
ý
ºP
ý
ºQ
~
º@ý
ºÝ
ý
ºÝ
ý
»àý
»R
ý
»S
ý
»?
ý
Ȓ~
»@ý
»Ý
ý
»Ý
ý
¼áý
¼@
ý
¼A
ý
¼Ìý
¼B

Page 54
 391424375

~
¼@ý
¼Ý
ý
¼Ý
ý
½âý
½C
ý
½D

ý
½C
ý
½í~
½@ý
½Ý
ý
½Ý
ý
¾ãý
¾uý
¾½ý
¾½ý
¾½~
¾@ý
¾Ý
ý
¾Ý
ý
¿äý
¿vý
¿½ý
¿½ý
¿½~
¿@ý
¿Ý
ý
¿Ý
×D
VlbpppTppppppppppppppppppppppppppÀà%Á
À$€Âð ’€$Ã
€ÄÐ ’Å
ð ’ÃÆ° ’ÇðÀ’ÃÈðÿ 
Éðÿ 
ÊðÐTHƒËð“ÌðÐTXƒÍ “"„ÎðÏð
Ð ¤¼ÑÐÃHƒÒðÀ“„ÓðÀ“ÔðÕð$Öà×àØ €ÙàÚà$ÛÐõÜðŠ€$ÀÝp0”Þð€ßðè”@ý
Àåý
ÀE
ý
À9
ý
ÀF
ý
Àí~

Page 55
 391424375

À@ý
ÀÝ
ý
Àwý
Á
æý
Á
xý
Á
:
ý
Á
;
ý
Á
í~
Á
@ý
Á
Ý
ý
Á
›
ý
Â$ý
Â$yý
Ãý
Ãzý
ÃX
ý
Ãý
ÃY
~
Ãð?ý
ÃÝ
ý
ÃÝ
ý
Äý
ijý
Ä´ý
ĵý
Ķ~
Ä@ý
ÄÝ
ý
ÄÝ
ý
Å
ý
Å
{ý
Å
½ý
Å
½ý
Å
½~
Å
@ý
Å
Ý
ý
Å
Ý

Page 56
 391424375

ý
Æý
Æ|ý
ƺý
Æ·ý
Ƹ~
Æ@ý
ÆÝ
ý
ÆÝ
ý
Çý
ǹý
ǽý
ǽý
ǽ~
Ç@ý
ÇÝ
ý
ÇÝ
ý
È!
ý
È}ý
Ƚý
Ƚý
Ƚ~
È@ý
ÈÝ
ý
ÈÝ
ý
É"ý
É~ý
ɽý
ɽý
ɽ~
É@ý
ÉÝ
ý
ÉÝ
ý
Ê#ý
Êý
ʽý
ʽý
ʽ~
Ê@ý
ÊÝ
ý

Page 57
 391424375

ÊÝ
ý
Ë$ý
Ë€ý
˽ý
˽ý
˽~
Ë@ý
ËÝ
ý
ËÝ
ý
Ì%ý
Ìý
̽ý
̽ý
̽~
Ì@ý
ÌÝ
ý
ÌÝ
ý
Í&ý
Í»ý
ͽý
ͼý
ͤ~
Í@ý
ÍÝ
ý
ÍÝ
ý
Î'ý
΂ý
νý
νý
ν~
Î@ý
ÎÝ
ý
ÎÝ
ý
Ï(ý
σý
Ͻý
Ͻý
Ͻ~
Ï@ý
ÏÝ

Page 58
 391424375

ý
ÏÝ
ý
Ð)ý
Ð¥ý
Цý
Чý
Ш~
Ðð?ý
ÐÝ
ý
ÐÝ
ý
Ñ*ý
Ñ«ý
Ѭ
ý
Ñ©ý
Ѫ~
Ñ@ý
ÑÝ
ý
ÑÝ
ý
Ò+ý
Ò„ý
Ò½ý
Ò½ý
Ò½~
Ò@ý
ÒÝ
ý
ÒÝ
ý
Ó
Ó…ý
Ó½ý
Ó½ý
Ó½~
Ó@ý
ÓÝ
ý
ÓÝ
ý
Ô-ý
Ô†ý
Ô½ý
Ô½ý
Ô½~
Ôð?ý

Page 59
 391424375

ÔÝ
ý
Ô‡ý
Õ.ý
Õˆý
Õ½ý
Õ½ý
Õ½~
Õ@ý
ÕÝ
ý
ÕÝ
ý
Ö/ý
Ö‰ý
Ö½ý
Ö½ý
Ö½~
Ö@ý
ÖÝ
ý
ÖÝ
ý
×0ý
×ý
×®


~
×@ý
×Ý
ý
×Ý
ý
Ø1ý
دý
Ø3ý
Ø•~
Ø@ý
ØÝ
ý
Ø–
ý
Ù2ý
ÙŠý
Ù½ý
Ù½ý
Ù½~
Ù@ý
ÙÝ
ý
ÙÝ

Page 60
 391424375

ý
Ú3ý
Ú‹ý
Ú½ý
Ú½ý
Ú½~
Ú@ý
ÚÝ
ý
ÚÝ
ý
Ûý
ÛZ
ý
Û±ý
Û²~
Ûð?ý
ÛÝ
ý
ÛÝ
ý
Ü$4ý
Ü$Œ

ý
Ý5ý
ÝÊý
݆ý
ÝÌý
݇~
Ýð?ý
ÝÝ
ý
ÝÝ
ý
Þ8ý
Þý
Þ½ý
Þ½ý
Þ½~
Þ@ý
ÞÝ
ý
ÞÝ
ý
ß9ý
ߎý
ß½ý
ß½ý
ß½~
ß@ý

Page 61
 391424375

ßÝ
ý
ßÝ
×D
lppppppppppppppppppppppTbppbppàà%á€$€âð ’$ãà€äÐ ’åà ’ÃæÀ ’çàÀ’Ãè°ÿ 
éÐÿ 
êðÐTHƒëð“ìðÐTXƒíð “"„îðï°
ð¤¼ñàÃHƒòðÀ“„óðÀ“ôðõà$öà÷
àøð€ùðúð$û°õüÀŠ$Àýð0”þ €ÿ 
ðè”@ý
à:ý
àý
à(ý
à)ý
à*~
à@ý
àý
àÝ
ý
á;ý
áˆý
áËý
á1ý
á2~
á@ý
áÝ
ý
áÝ
ý
â<ý
â3ý
â4ý
â5ý
â1
~
â@ý
âÝ
ý
âÝ
ý
ã=ý
ã6ý
ã7ý
ã8ý
ã1
~
ã@ý
ãÝ
ý
ãÝ
ý
ä>ý
ä9ý
ä:ý

Page 62
 391424375

ä;ý
äÒ~
ä@ý
äÝ
ý
äÝ
ý
å?ý
å‘ý
å½ý
å½ý
å½~
å@ý
åÝ
ý
åÝ
ý
æ6ý
æ’ý
æý
æý
æ~
æð?ý
æÝ
ý
æÝ
ý
ç7ý
çý
çý
çý
ç~
ç@ý
çÝ
ý
çÝ
ý
è8ý
èý
èý
èý
èÒ~
è@ý
èÝ
ý
èÝ
ý
é7ý
é

Page 63
 391424375

ý
éƒý
é„ý
é…~
é@ý
éÝ
ý
éÝ
ý
ê9ý
ê“ý
ê½ý
ê½ý
ê½~
êð?ý
êÝ
ý
êÝ
ý
ë:ý
ë”ý
ë½ý
ë½ý
ë½~
ë@ý
ëÝ
ý
ëÝ
ý
ì;ý
ì•ý
ì½ý
ì½ý
ì½~
ì@ý
ìÝ
ý
ìÝ
ý
í<ý
í–ý
í½ý
í½ý
í½~
í@ý
íÝ
ý
íÝ
ý

Page 64
 391424375

î=ý
î—ý
î½ý
î½ý
î½~
î@ý
îÝ
ý
îÝ
ý
ï>ý
ï‰ý
ï–ý
ï+ý
ï
ï@ý
ïÝ
ý
ïÝ
ý
ð?ý
ðÇý
ðÈý
ðÉý
ð
ðð?ý
ðÝ
ý
ðÝ
ý
ñ@ý
ñ˜ý
ñ½ý
ñ½ý
ñ½~
ñ@ý
ñÝ
ý
ñÝ
ý
òAý
ò™ý
ò½ý
ò½ý
ò½~
òð?ý
òÝ
ý
òÝ

Page 65
 391424375

ý
óBý
óšý
ó½ý
ó½ý
ó½~
óð?ý
óÝ
ý
óÝ
ý
ôCý
ô›ý
ô½ý
ô½ý
ô½~
ôð?ý
ôÝ
ý
ôÝ
ý
õD
ý
õœý
õ½ý
õ½ý
õ½~
õ@ý
õÝ
ý
õÝ
ý
öEý
öý
ö½ý
ö½ý
ö½~
ö@ý
öÝ
ý
öÝ
ý
÷
Fý
÷
žý
÷
½ý
÷
½ý
÷
½~
÷
@ý
÷
Ý
ý

Page 66
 391424375

÷
Ý
ý
ø@ý
øŸý
ø½ý
ø½ý
ø½~
øð?ý
øÝ
ý
øÝ
ý
ùAý
ù ý
ù½ý
ù½ý
ù½~
ù@ý
ùÝ
ý
ùÝ
ý
ú’ý
ú¡ý
ú½ý
ú½ý
ú½~
úð?ý
úÝ
ý
úÝ
ý
û“ý
ûÍý
ûSý
ûÙ
ý
û1
~
û@ý
ûÝ
ý
ûÝ
ý
ü”ý
üÚ
ý
ü[
ý

Page 67
 391424375

üuý
ü~
ü@ý
üÝ
ý
üÝ
ý
ý4ý
ý¢ý
ý½ý
ý½ý
ý½~
ý@ý
ýÝ
ý
ýÝ
ý
þ5ý
þvý
þxý
þwý
þ1
~
þ@ý
þÝ
ý
þÝ
ý
ÿ 
6ý
ÿ 
£ý
ÿ 
½ý
ÿ 
½ý
ÿ 
½~
ÿ 
@ý
ÿ 
Ý
ý
ÿ 
Ý
×D
€lpppppppppppppppppppppppppppppppð€$€$€À ’$à€ð ’ð ’Ãð ’ðÀ’ÃÐÿ 
 àÿ 

ðÐTHƒð“àÐTXƒ
ð “"„ðà
Ф¼àÃHƒàÀ“„ðÀ“€$pÐ$à ЀàÀ$ÐõÀŠ$Àà0”ð€ðè”@ý
$Gý
$Šý
Hý
yý
zý
øý
~
ð?ý

Page 68
 391424375

Ý
ý
Ý
ý
Iý
{ý
|ý
}ý
~
ð?ý
Ý
ý
Ý
ý
Jý
8ý
ý
€ý
~~
@ý
Ý
ý
Ý
ý
Ký
9ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
Lý
:ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
Mý
;ý
½ý
½ý
½~

Page 69
 391424375

@ý
Ý
ý
Ý
ý
Ný
<ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
Oý
ùý
úý
ûý
í~
@ý
Ý
ý
Ý
ý
Pý
þý
ýý
ÿ 
ý
í~
@ý
Ý
ý
Ý
ý

Qý

½ý

½ý

½ý

½~

@ý

Ý

Page 70
 391424375

Ý
ý
Rý
½ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
Sý
=ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý

Tý

>ý

½ý

½ý

½~

@ý

Ý
ý

Ý
ý
Uý
?ý
½ý
½ý
½~
@ý
Ý

Page 71
 391424375

ý
Ý
ý
Vý
@ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
Wý
ý
ý
ý
ü~
@ý
Ý
ý
Ý
ý
Xý
Aý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
Yý
Bý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
$Zý
$Cý
[ý
ý
lý
ý

Page 72
 391424375

k~
@ý
Ý
ý
Ý
ý
\ý
D
ý
mý
tý
_~
@ý
Ý
ý
Ý
ý
]ý
Eý
`
ý
aý
í~
@ý
Ý
ý
Ý
ý
^ý
Fý
bý
cý
d~
@ý
Ý
ý
Ý
ý
^ý
Gý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
_ý
Hý
eý

Page 73
 391424375

fý
ü~
@ý
Ý
ý
Ý
ý
uý
gý
hý
iý
í~
@ý
Ý
ý
Ý
ý
vý
ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
wý
+ý
jý

í~
@ý
Ý
ý
Ý
ý
†ý
ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
‡ý
ý

Page 74
 391424375

½ý
½ý
½~
@ý
Ý
ý
Ý
ý
ˆý
õý
½ý
½ý
½~
@ý
Ý
ý
Ý
×D
Ølppppppppppppppppppppppppppppp ð$!
$€"ð ’$#€$Ð ’%à ’Ã&à ’'àÀ’Ã(ðÿ 
)àÿ 
*àÐTHƒ+à“
0़1àÃHƒ2ðÀ“„3ðÀ“$4ð5à$6ð7À8ð€9à:à$;àõ<ÀŠ$À=ð0”>À€?àè”@ý
‰ý
ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý
!
Šý
!
-ý
!
.ý
!
/ý
!
í~
!
@ý
!
Ý
ý
!
Ý
ý
‹ý
0ý
½ý
½ý
½~
@ý
Ý
ý
Ý
ý

Page 75
 391424375

#Œ

ý
#1ý
#2ý
#7
ý
#
~
#@ý
#Ý
ý
#Ý
ý
$ý
$ý
$½ý
$½ý
$½~
$@ý
$Ý
ý
$Ý
ý
%Žý
%ý
%½ý
%½ý
%½~
%@ý
%Ý
ý
%Ý
ý
&ý
&ý
&½ý
&½ý
&½~
&@ý
&Ý
ý
&Ý
ý
'ý
'ý
'½ý
'½ý
'½~
'@ý
'Ý

Page 76
 391424375

ý
'Ý
ý
(‘ý
(ý
(½ý
(½ý
(½~
(ð?ý
(Ý
ý
(Ý
ý
)’ý
)ý
)½ý
)½ý
)½~
)@ý
)Ý
ý
)Ý
ý
*“ý
*ý
*½ý
*½ý
*½~
*@ý
*Ý
ý
*Ý
ý
+”ý
+ý
+½ý
+½ý
+½~
+@ý
+Ý
ý
+Ý
ý

Page 77
 391424375

ý
-aý
-!
ý
-½ý
-½ý
-½~
-@ý
-Ý
ý
-Ý
ý
.bý
.ý
.ý
.ý
.ü~
.@ý
.Ý
ý
.Ý
ý
/cý
/(ý
/ý
/ý
/~
/ð?ý
/Ý
ý
/Ý
ý
0dý
0šý
0½ý
0½ý
0½~
0@ý
0Ý
ý
0Ý
ý
1eý
1"ý
1–ý
1˜ý
1—~
1@ý

Page 78
 391424375

1Ý
ý
1Ý
ý
2fý
2#ý
2½ý
2½ý
2½~
2@ý
2Ý
ý
2Ý
ý
3gý
3$ý
3½ý
3½ý
3½~
3@ý
3Ý
ý
3Ý
ý
4hý
4%ý
4½ý
4½ý
4½~
4@ý
4Ý
ý
4Ý
ý
5iý
5™ý
5›ý
5œý
5~
5@ý
5Ý
ý
5Ý
ý
6jý
6&ý
6½ý
6½ý
6½~

Page 79
 391424375

6@ý
6Ý
ý
6–
ý
7ký
7'ý
7žý
7Sý
7]~
7@ý
7Ý
ý
7Ý
ý
8lý
8Tý
8U~
8ð?ý
8Ý
ý
8Ý
ý
9mý
9þý
9½ý
9½ý
9½~
9ð?ý
9Ý
ý
9Ý
ý
:ný
:ÿ 
ý
:½ý
:½ý
:½~
:ð?ý
:Ý
ý
:Ý
ý
;oý
;
ý
;V~
;ð?ý
;Ý

Page 80
 391424375

ý
;Ý
ý
<pý
<Wý
<Xý
<Yý
<Z~
<@ý
<Ý
ý
<Ý
ý
Err:501
Err:501
ý
Err:501
Err:501
Err:501
Err:501
Err:501
ý
Err:501
ý
>rý
>
ý
>[ý
>\ý
>¡~
>@ý
>Ý
ý
>Ý
ý
?sý
?
ý
?½ý
?½ý
?½~
?@ý
?Ý
ý
?Ý
×D
:lppppppppppppbpppppppppppTppTppp@à$Að$€Bð ’$C €D
à ’Eð ’ÃFà ’GðÀ’ÃHðÿ 
Iðÿ 
JðÐTHƒKð“LÐÐTXƒMÀ “"„NÀOD
@
Q‰
¤¼@ý
@tý

Page 81
 391424375

@
ý
@½ý
@½ý
@½~
@@ý
@Ý
ý
@Ý
ý
Axý
A
ý
A½ý
A½ý
A½~
A@ý
AÝ
ý
AÝ
ý
Byý
B
ý
B½ý
B½ý
B½~
B@ý
BÝ
ý
BÝ
ý
Czý
C¢ý
CŽý
C½~
C@ý
CÝ
ý
CÝ
ý
D
{ý
D

ý
D
½ý
D
½ý
D
½~
D
@ý
D
Ý

Page 82
 391424375

ý
D
Ý
ý
E|ý
E
ý
E½ý
E½ý
E½~
E@ý
EÝ
ý
EÝ
ý
F}ý
F
ý
F½ý
F½ý
F½~
Fð?ý
FÝ
ý
F‘
ý
G~ý
GÏý
G½ý
G½ý
G½~
G@ý
GÝ
ý
G‘
ý
Hý
HÐý
H½ý
H½ý
H½~
H@ý
HÝ
ý
H‘
ý
I€ý
IÑý
I½ý
I½ý

Page 83
 391424375

I½~
I@ý
IÝ
ý
I‘
ý
Jý
JÒý
J½ý
J½ý
J½~
J@ý
JÝ
ý
J‘
ý
K‚ý
KÓý
K½ý
K½ý
K½~
K@ý
KÝ
ý
K‘
ý
Lƒý
LÔý
Lý
Lý
L‘~
Lð?ý
LÝ
ý
L‘
ý
M„ý
M’ý
M“ý
M”ý
M‘~
Mð?ý
MÝ
ý
MÝ
ý
N…ý
N•ý
N—ý

Page 84
 391424375

N–ý
N˜~
N@ý
NÝ
ý
NÝ
ý
O•ý
Oý
O'ý
Ošý
O™ý
Q°ý
Q&×&8@pppbpppppppppppF>¶@ÈÈ@
Å
=ÌÈÀOsú‹)õ
dü©ñÒMbP?_*+‚€%
}UB!
}Õ!
}ª!
}€!
O

!
Ÿý
!
ý
!
¡ý
!
¢~
!
k<´ý
!
£ý
!
\~
!
k‰Šý
!
]ý
!
^~
!
ëOSý
!
_ý
!
`
~
!
ûÊ
!
aý
!
b~
!
kSHý
!
cý
!
d~
!
ûTHý
!
eý
!
f~
!
kÉ
!
gý
!
h~
!
/ý
!
iý
!
j~
!
Keý
!
ký

Page 85
 391424375

!
l~

!
‹‰ý

!
iý
!
m~
!
˲Þý
!
ný
!
o~
!
[sÔý
!
pý

!
.~

!
›MÓý

!
/ý
!
0~
!
‹
Óý
!
/ý
!
¾~
!
k•§ý
!
¿ý
!
À~
!
í›ý
!
Á
ý
!
Â~
!
«vwý
!
Ãý
!
Ä~
!
uwý
!
Å
ý
!
Æ~
!
‹swý
!
Å
ý
!
Ç~
!
ûqwý
!
Å
ý
!
È~
!
kpwý
!
Å
ý
!
É~
!
€Xý
!
Êý
!
Ë~
!
+ý
!
Ìý

Page 86
 391424375

!
Í~
!
kSý
!
Îý
!
Ï~
!
•ý
!
Ðý
!
Ñ~
!
û‘ý
!
Ðý
!
Ò~
!
ÛŽý
!
Óý
!
Ô~
!
«ñý
!
Õý
!
Ö~
!
ûñý
!
×ý
!
Ø~
!
ñý
!
Ùý
!
Ú~
!
kñý
!
××D
Àl*******************************
!
Û½ !
Kˆé!
Lâ@ý
!
!
ܽ!
!
;Ê!
Iâ@ý
!
ݽ"!
Û¼»!
€D
â@ý
#!
Þ½#!
+Ñ»!
€D
â@ý
$!
ß½$!
Kši!
`
>â@ý
%!
à½%!
»˜i!
`
>â@ý
&!
á½&!
kTX!
`
<â@ý
'!
›½'!
kV`
!
9â@ý
(!
œ½(!
û».!
zâ@ý
)!
½)!
kº.!
@Hâ@ý
*!
ž½*!
ëS!
0â@ý
+!
Ÿ½+!
§!
ÀŸâ@ý

-!
¡ý
-!
¢ý
-!
½ý
.!
£~
.!
;Kû~
/!
ëOû½0!
›Tû!
@â@ý
1!
¤½1!
û|ú!
@Râ@ý
2!
¥½2!
Nç!
À'â@ý
3!
¦½3!
›Oç!
À'â@ý
4!
§½4!
+Qç!
-â@ý
5!
¨½5!
»Rç!
À'â@ý
6!
©½6!
ë~¤!
à%â@ý

Page 87
 391424375

7!
ª½7!
ë7›!
Pâ@ý
8!
«½8!
[6›!
Pâ@ý
9!
¬
~
9!
{9›~
:!
Ëf›~
;!
[h›½<!
ëi›!
@5â@~
Err:501
>!
Pâ@~
?!
Pâ@×D
Vl$$$$$$$$$$$$$*$$$$$$$$@
@!
½@!
;š§!

A!
®


ý
A!
¯~
A!
â@ý
B!
°ý
B!
¯~
B!
`
â@ý
C!
±ý
C!
¯~
C!
àâ@ý
D
!
²½D
!
{`
=!
À²â@ý
E!
³ý
E!
¯~
E!
àâ@ý
F!
´ý
F!
¯~
F!
@â@ý
G!
µý
G!
¯~
G!
@â@ý
H!
¶ý
H!
¯~
H!
@â@ý
I!
·ý
I!
¯~
I!
â@ý
J!
¸ý
J!
¯~
J!
â@ý
K!
¹½K!
/!
À=â@ý
L!
º½L!
‹]ù!
À¥â@ý
M!
»½M!
[”!
`
5â@ý
N!
¼ý
N!
¯~
N!
Àâá@×"„$***$******$$$>¶@ÈÈ@ ï7
Å
=ÌÈÀ\Vs}ý)
79D
½Pk]Cjaw·„ÿ 
‘ ç«%¸¥Å
‹Òß“ë%ø
dü©ñÒMbP?_*+‚€%
}*"}€"}ª"}U"}Õ"}€+"}*"}€"}*"V

Page 88
 391424375

'~
"@ý
"(ý
"(ý
")ý
"*ý
"'~
"@ý
"+ý
"
"-ý
".ý
"'~
"@ý
"¸ý
"¹ý
"ºý
"»ý
"'~
"@ý
"¼ý
"¼ý
"½ý
"¾ý
"'~
"@ý
"¿ý
"¿ý
"Àý
"Á
ý
"'~
"@ý
"Âý
"Ãý
"Äý
"Å
ý
"'~
"@ý
"Æý
"Æý
"Çý
"Èý
"'~
"@ý
"Éý
"Éý
"Êý
"Ëý

Page 89
 391424375

"'~
"@ý
"Ìý
"Ìý
"Íý
"Îý
"'~
"@ý
"Ìý
"Ïý
"Ðý
"Îý

'~

"@ý

"Ìý

"Ñý

"Òý

"Îý
"'~
"@ý
"Óý
"Óý
"Ôý
"Îý
"'~
"@ý
"Õý
"Õý
"Öý
"Îý

'~

"@ý

"×ý

"×ý

"Øý

"Îý
"'~

Page 90
 391424375

"@ý
"Ùý
"Ùý
"Úý
"Ûý
"'~
"@ý
"Üý
"Üý
"Ýý
"Þý
"ßý
"'~
"@ý
"àý
"àý
"áý
"âý
"'~
"@ý
"ãý
"ãý
"äý
"åý
"'~
"@ý
"æý
"æý
"çý
"èý
"'~
"@ý
"éý
"éý
"êý
"ëý
"ìý
"'~
"@ý
"éý
"íý
"îý
"ëý
"ìý
"'~
"@ý
"ïý
"ïý
"ðý

Page 91
 391424375

"ñý
"ìý
"'~
"@ý
"ïý
"íý
"òý
"ñý
"ìý
"'~
"@ý
"óý
"ôý
"õý
"Îý
"'~
"@ý
"öý
"÷
ý
"”ý
"'~
"@ý
"•ý
"÷
ý
"–ý
"'~
"@ý
"—ý
"—ý
"˜ý
"™ý
"ßý
"'~
"ð?ý
"šý
"šý
"›ý
"œý
"ý
"žý
"'~
"@ý
"Ÿý
"Ÿý
"ý
"¡ý
"'~
"@ý
"¢ý

Page 92
 391424375

"¹ý
"£ý
"¤ý
"'~
"@ý
"¥ý
"¹ý
"¦ý
"§ý
"'~
"@ý
"¨ý
"¨ý
"©ý
"ªý
"ß×D
b
lTTTTTTTTTTTTTTTbTTTbbbbTFFbpTTT
'~
"@ý
"«ý
"«ý
"¬
ý
"ý
"ßý
!
"'~
!
"@ý
!
"®


ý
!
"®


ý
!
"¯ý
!
"°ý
"'~
"@ý
"±ý
"±ý
"²ý
"³ý
#"'~
#"@ý
#"´ý
#"´ý
#"µý
#"¶ý
$"'~
$"@ý
$"·ý
$"·ý
$"¸ý
$"¹ý
%"'~

Page 93
 391424375

%"@ý
%"ºý
%"ºý
%"»ý
%"¶ý
&"'~
&"@ý
&"¼ý
&"¼ý
&"½ý
&"¶ý
'"'~
'"@ý
'"¾ý
'"¾ý
'"¿ý
'"Àý
("'~
("@ý
("Á
ý
("Á
ý
("Âý
("Ãý
)"'~
)"@ý
)"Äý
)"Äý
)"Å
ý
)"Æý
*"'~
*"@ý
*"Çý
*"Çý
*"Bý
*"Cý
+"'~
+"@ý
+"D
ý
+"D
ý
+"Eý
+"Fý

-"'~
-"ð?ý

Page 94
 391424375

-"Gý
-"Iý
-"Jý
-"Hý
-"žý
."'~
."ð?ý
."Gý
."Gý
."Ký
."Hý
."žý
/"'~
/"ð?ý
/"Gý
/"Ñý
/"Lý
/"Hý
/"žý
0"'~
0"@ý
0"Mý
0"Mý
0"Ný
0"Oý
0"ßý
1"'~
1"@ý
1"Pý
1"Pý
1"Qý
1"Rý
2"'~
2"@ý
2"Sý
2"Sý
2"Tý
2"Uý
3"'~
3"@ý
3"Vý
3"Vý
3"Wý
3"¶ý
4"'~
4"@ý
4"Xý
4"Xý
4"Yý

Page 95
 391424375

4"Zý
5"'~
5"@ý
5"[ý
5"[ý
5"\ý
5"]ý
6"'~
6"@ý
6"^ý
6"^ý
6"_ý
6"`
ý
7"'~
7"@ý
7"aý
7"aý
7"bý
7"cý
8"'~
8"@ý
8"dý
8"dý
8"eý
8"fý
9"'~
9"@ý
9"gý
9"hý
9"iý
:"'~
:"@ý
:"jý
:"÷
ý
:"ký
:"Îý
;"'~
;"@ý
;"jý
;"Iý
;"lý
;"Îý
<"'~
<"@ý
<"jý
<"jý
<"mý
<"Îý

Page 96
 391424375

Err:501
Err:501
Err:501
Err:501
Err:501
>"'~
>"@ý
>"qý
>"qý
>"rý
>"sý
?"'~
?"@ý
?"tý
?"tý
?"uý
?"v×D
8
lbTTTTTTTTTTTTbbbbTTTTTTTTFTTTTT@
@"'~
@"@ý
@"wý
@"wý
@"xý
@"yý
A"'~
A"@ý
A"zý
A"zý
A"{ý
A"¨ý
B"'~
B"@ý
B"©ý
B"©ý
B"ªý
B"«ý
C"'~
C"@ý
C"¬
ý
C"¬
ý
C"ý
C"ý
D
"'~
D
"@ý
D
"ý
D
"ý
D
"ý
D
"ý
E"'~

Page 97
 391424375

E"@ý
E"ý
E"ý
E"ý
E"ý
F"'~
F"@ý
F"ý
F"ý
F"ý
F"ý
G"'~
G"@ý
G" ý
G" ý
G"!
ý
G""ý
H"'~
H"@ý
H"#ý
H"#ý
H"$ý
I"'~
I"@ý
I"%ý
I"%ý
I"&ý
I"Ùý
J"'~
J"@ý
J"Úý
J"Úý
J"Ûý
J"¶ý
K"'~
K"@ý
K"Üý
K"Üý
K"Ýý
K"Þý
L"'~
L"@ý
L"ßý
L"ßý
L"àý
L"áý
M"'~
M"@ý
M"âý

Page 98
 391424375

M"âý
M"ãý
M"äý
N"'~
N"@ý
N"åý
N"åý
N"æý
N"çý
O"'~
O"@ý
O"èý
O"èý
O"éý
O"êý
P"'~
P"@ý
P"ëý
P"ëý
P"ìý
P"íý
Q"'~
Q"@ý
Q"îý
Q"îý
Q"ïý
Q"ðý
R"'~
R"@ý
R"ñý
R"ñý
R"òý
R"óý
S"'~
S"@ý
S"ôý
S"ôý
S"õý
S"öý
T"'~
T"@ý
T"÷
ý
T"÷
ý
T"øý
T"ùý
U"'~
U"@ý
U"úý
U"úý

Page 99
 391424375

U"ûý
U"üý
V"'~
V"@ý
V"ýý
V"ýý
V"þý
V"ÿ 
ý
W"'~
W"@ý
W"ý
W"ý
W"ý
W"¶ý
X"'~
X"@ý
X"ý
X"ý
X"ý
X"ý
Y"'~
Y"@ý
Y"ý
Y"ý
Y"ý
Y"¶ý
Z"'~
Z"@ý
Z"ý
Z"ý
Z"ý
["'~
["@ý
["ý
["
ý
["ý
\"'~
\"@ý
\"ý
\"ý
\"
ý
]"'~
]"@ý
]"ý
]"
ý
]"ý

Page 100
 391424375

^"'~
^"@ý
^"ý
^"ý
^"ý
^"ý
^"ßý
_"'~
_"@ý
_"ý
_"ý
_"ý
_"¾×D
ÈlTTTTTTTTFTTTTTTTTTTTTTTTTTFFFFb`

`
"'~
`
"@ý
`
"¿ý
`
"¿ý
`
"Àý
`
"Á
ý
a"'~
a"@ý
a"Âý
a"Âý
a"Ãý
a"Äý
b"'~
b"@ý
b"Å
ý
b"Å
ý
b"Æý
b"Çý
c"'~
c"@ý
c"Èý
c"Èý
c"Éý
c"Êý
d"'~
d"@ý
d"Ëý
d"Ëý
d"Ìý
d"ý
e"'~
e"@ý
e"ý
e"ý
e"ý
e"ý

Page 101
 391424375

f"'~
f"@ý
f"ý
f"ý
f"ý
f"ý
g"'~
g"@ý
g"ý
g"ý
g"Æý
g"Çý
g"ßý
h"'~
h"@ý
h"Èý
h"Éý
h"Êý
h"Ëý
i"'~
i"@ý
i"Ìý
i"Ìý
i"Íý
i"Îý
j"'~
j"@ý
j"Ïý
j"Ïý
j"Ðý
j"Ñý
k"'~
k"@ý
k"Òý
k"Òý
k"Óý
k"Ôý
l"'~
l"@ý
l"Õý
l"Öý
l"×ý
l"Îý
m"'~
m"@ý
m"Øý
m"Øý
m"Ùý
m"Úý

Page 102
 391424375

n"'~
n"@ý
n"Ûý
n"Ûý
n"Üý
n"¶ý
o"'~
o"@ý
o"Ýý
o"Ýý
o"Þý
o"¶ý
p"'~
p"@ý
p"ßý
p"àý
p"áý
p"»ý
q"'~
q"@ý
q"âý
q"âý
q"ãý
q"äý
r"'~
r"@ý
r"åý
r"åý
r"æý
s"'~
s"@ý
s"çý
s"çý
s"èý
s"éý
t"'~
t"@ý
t"êý
t"ëý
t"ìý
t"íý
t"îý
u"'~
u"@ý
u"ïý
u"ïý
u"ðý
v"'~
v"@ý

Page 103
 391424375

v"ñý
v"òý
v"óý
v"ôý
w"'~
w"@ý
w"õý
w"öý
w"÷
ý
x"'~
x"@ý
x"øý
x"¹ý
x"ùý
y"'~
y"@ý
y"úý
y"úý
y"ûý
y"üý
z"'~
z"@ý
z"ýý
z"ýý
z"þý
{"'~
{"@ý
{"ÿ 
ý
{"ý
{"ý
{"ý
|"'~
|"@ý
|"ÿ 
ý
|"ý
|"ý
}"'~
}"@ý
}"ý
}"ý
}"ý
}"ý
~"'~
~"ð?ý
~"ý
~"ý
~"ý
~"
ý

Page 104
 391424375

~"ý
~"žý
"'~
"@ý
"ý
"ý
"ý
"~×D
älTTTTTTTbTTTTTTTTTTFTbFTFFTFTFTp€
€"'~
€"@ý
€"ý
€"ý
€"€ý
€"ý
€"ßý
"'~
"@ý
"ý
"ý
"‚ý
‚"'~
‚"@ý
‚"ƒý
‚"ƒý
‚"„ý
‚"üý
ƒ"'~
ƒ"@ý
ƒ"…ý
ƒ"…ý
ƒ"†ý
„"'~
„"@ý
„"‡ý
„"‡ý
„"ˆý
…"'~
…"@ý
…"‰ý
…"‰ý
…"Šý
†"'~
†"@ý
†"‰ý
†"‹ý
†"Œ

ý
‡"'~
‡"@ý
‡"‰ý

Page 105
 391424375

‡"Ñý
‡"ý
ˆ"'~
ˆ"@ý
ˆ"Žý
ˆ"ý
ˆ"ý
‰"'~
‰"@ý
‰"‘ý
‰"‘ý
‰"’ý
Š"'~
Š"@ý
Š"“ý
Š"“ý
Š"”ý
Š"•ý
Š"ßý
‹"'~
‹"@ý
‹"–ý
‹"–ý
‹"—ý
‹"˜ý
Œ

"'~
Œ

"@ý
Œ

"™ý
Œ

"™ý
Œ

"šý
Œ

"›ý
"'~
"@ý
"œý
"œý
"ý
"žý
Ž"'~
Ž"@ý
Ž"Ÿý
Ž"Ÿý
Ž" ý
Ž"¡ý
"'~
"@ý
"¢ý
"£ý
"¤ý
"'~

Page 106
 391424375

"@ý
"¥ý
"¥ý
"¦ý
"§ý
‘"'~
‘"@ý
‘"¨ý
‘"¨ý
‘"©ý
‘"ªý
’"'~
’"@ý
’"«ý
’"«ý
’"¬
ý
“"'~
“"@ý
“"ý
“"ý
“"®


ý
”"'~
”"@ý
”"¯ý
”"¯ý
”"°ý
•"'~
•"@ý
•"±ý
•"²ý
•"³ý
•"´ý
–"'~
–"@ý
–"µý
–"¶ý
–"·ý
–"»ý
—"'~
—"@ý
—"¸ý
—"¹ý
—"¹ý
—"»ý
˜"'~
˜"@ý
˜"ºý
˜"»ý
˜"¼ý

Page 107
 391424375

˜"»ý
™"'~
™"@ý
™"½ý
™"¾ý
™"¿ý
™"»ý
š"'~
š"@ý
š"Àý
š"÷
ý
š"Á
ý
›"'~
›"@ý
›"Âý
›"Âý
›"Ãý
›"Äý
œ"'~
œ"@ý
œ"Âý
œ"÷
ý
œ"Å
ý
"'~
"@ý
"Bý
"Bý
"Cý
ž"'~
ž"@ý
ž"D
ý
ž"÷
ý
ž"Eý
Ÿ"'~
Ÿ"@ý
Ÿ"D
ý
Ÿ"D
ý
Ÿ"Fý
Ÿ"E×D
<lbFTFFFFFFFbTTTTFTTFFFTTTTTFTFFF
"'~
"@ý
"Gý
"Gý
"Hý
¡"'~
¡"@ý
¡"Iý
¡"Jý
¡"Ký

Page 108
 391424375

¢"'~
¢"@ý
¢"Lý
¢"Lý
¢"Mý
¢"Ný
£"'~
£"@ý
£"Oý
£"Oý
£"Pý
£"Qý
¤"'~
¤"@ý
¤"Rý
¤"Rý
¤"Sý
¤"Tý
¥"'~
¥"@ý
¥"Uý
¥"Iý
¥"Vý
¥"Îý
¦"'~
¦"@ý
¦"Uý
¦"Ñý
¦"Wý
§"'~
§"@ý
§"Uý
§"Uý
§"Xý
§"Yý
§"ßý
¨"'~
¨"@ý
¨"Zý
¨"÷
ý
¨"[ý
¨"\ý
©"'~
©"@ý
©"]ý
©"]ý
©"^ý
ª"'~
ª"@ý

Page 109
 391424375

ª"_ý
ª"_ý
ª"`
ý
«"'~
«"@ý
«"aý
«"aý
«"bý
«"¶ý
¬
"'~
¬
"@ý
¬
"cý
¬
"cý
¬
"dý
¬
"eý
"'~
"@ý
"fý
"fý
"gý
"hý
®


"'~
®


"@ý
®


"iý
®


"iý
®


"jý
®


"¶ý
¯"'~
¯"@ý
¯"ký
¯"ký
¯"lý
¯"¶ý
°"'~
°"@ý
°"mý
°"mý
°"ný
°"oý
±"'~
±"@ý
±"pý
±"pý
±"qý
±"rý
²"'~
²"@ý
²"sý
²"sý

Page 110
 391424375

²"tý
²"uý
³"'~
³"@ý
³"vý
³"vý
³"wý
³"xý
´"'~
´"@ý
´"yý
´"zý
´"{ý
´"|ý
µ"'~
µ"@ý
µ"yý
µ"yý
µ"ñý
µ"|ý
¶"'~
¶"@ý
¶"òý
¶"öý
¶"½ý
¶"Wý
·"'~
·"@ý
·"òý
·"òý
·"Xý
·"Wý
¸"'~
¸"@ý
¸"Yý
¸"ý
¸"Zý
¹"'~
¹"@ý
¹"[ý
¹"[ý
¹"\ý
¹"]ý
º"'~
º"@ý
º"^ý
º"^ý
º"_ý
»"'~

Page 111
 391424375

»"@ý
»"`
ý
»"`
ý
»"aý
¼"'~
¼"@ý
¼"bý
¼"bý
¼"cý
¼"dý
½"'~
½"@ý
½"eý
½"÷
ý
¾"'~
¾"@ý
¾"eý
¾"eý
¾"fý
¿"'~
¿"@ý
¿"ý
¿"ý
¿"g×D
flFFTTTTFbTFFTTTTTTTTTTTTTFTFFT8FÀ
À"'~
À"@ý
À"hý
À"iý
À"jý
À"ký
Á
"'~
Á
"@ý
Á
"lý
Á
"÷
ý
Á
"mý
Á
"ný
Â"'~
Â"@ý
Â"oý
Â"oý
Â"pý
Â"qý
Ã"'~
Ã"@ý
Ã"rý
Ã"rý
Ã"sý
Ä"'~
Ä"@ý

Page 112
 391424375

Ä"tý
Ä"tý
Ä"uý
Ä"vý
Å
"'~
Å
"@ý
Å
"wý
Å
"wý
Å
"xý
Å
"yý
Æ"'~
Æ"@ý
Æ"zý
Æ"zý
Æ"{ý
Æ"|ý
Ç"'~
Ç"@ý
Ç"}ý
Ç"}ý
Ç"~ý
Ç"ý
È"'~
È"@ý
È"€ý
È"€ý
È"ý
È"‚ý
É"'~
É"@ý
É"ƒý
É"ƒý
É"„ý
Ê"'~
Ê"@ý
Ê"…ý
Ê"†ý
Ê"‡ý
Ê"ˆý
Ë"'~
Ë"@ý
Ë"‰ý
Ë"‰ý
Ë"Šý
Ì"'~
Ì"@ý
Ì"‹ý
Ì"Œ

ý
Ì"ý

Page 113
 391424375

Í"'~
Í"@ý
Í"Žý
Í"Žý
Í"ý
Í"ý
Î"'~
Î"@ý
Î"‘ý
Î"‘ý
Î"’ý
Î"“ý
Ï"'~
Ï"@ý
Ï"”ý
Ï"÷
ý
Ï"•ý
Ð"'~
Ð"@ý
Ð"–~
Ð"Šw/ý
Ð"—ý
Ð"˜ý
Ñ"'~
Ñ"@ý
Ñ"™ý
Ñ"™ý
Ñ"šý
Ñ"ý
Ò"'~
Ò"@ý
Ò"ý
Ò"ý
Ò"ý
Ò"ý
Ó"'~
Ó"@ý
Ó"ý
Ó"ý
Ó" ý
Ó"!
ý
Ô"'~
Ô"@ý
Ô""ý
Ô""ý
Ô"#ý
Ô"$ý
Õ"'~
Õ"@ý

Page 114
 391424375

Õ"%ý
Õ"%ý
Õ"&ý
Õ"'ý
Ö"'~
Ö"@ý
Ö"(ý
Ö"(ý
Ö")ý
Ö"*ý
×"'~
×"@ý
×"+ý
×"
×"-ý
×".ý
Ø"'~
Ø"@ý
Ø"/ý
Ø"/ý
Ø"0ý
Ø"üý
Ù"'~
Ù"@ý
Ù"1ý
Ù"1ý
Ù"2ý
Ú"'~
Ú"@ý
Ú"3ý
Ú"÷
ý
Ú"4ý
Û"'~
Û"@ý
Û"5ý
Û"5ý
Û"6ý
Û"üý
Ü"'~
Ü"@ý
Ü"7ý
Ü"8ý
Ü"9ý
Ü":ý
Ý"'~
Ý"@ý
Ý";ý
Ý"÷
ý
Ý"<ý

Page 115
 391424375

Þ"'~
Þ"@ý
Þ";ý
Þ";ý
Þ"qý
Þ"<ý
ß"'~
ß"@ý
ß"rý
ß"rý
ß"sý
ß"t×D
lTTTFTTTTTFTFFTTFTTTTTTTTTFFTTFTà
à"'~
à"@ý
à"uý
à"uý
à"vý
á"'~
á"@ý
á"wý
á"wý
á"xý
á"yý
â"'~
â"@ý
â"zý
â"zý
â"{ý
â"|ý
ã"'~
ã"@ý
ã"}ý
ã"~ý
ã"ý
ä"'~
ä"@ý
ä"€ý
ä"€ý
ä"ý
å"'~
å"@ý
å"‚ý
å"‚ý
å"ƒý
å"„ý
å"ßý
æ"'~
æ"@ý
æ"…ý

Page 116
 391424375

æ"…ý
æ"†ý
æ"‡ý
ç"'~
ç"@ý
ç"ˆý
ç"ˆý
ç"‰ý
è"'~
è"@ý
è"Šý
è"Šý
è"‹ý
é"'~
é"@ý
é"Šý
é"Œ

ý
é"ý
ê"'~
ê"@ý
ê"Žý
ê"Žý
ê"ý
ê"ý
ë"'~
ë"@ý
ë"‘ý
ë"‘ý
ë"ý
ë"ý
ë"ßý
ì"'~
ì"@ý
ì"
ý
ì"
ý
ì"ý
ì"ý
ì"ßý
í"'~
í"@ý
í"ý
í"ý
í"ý
í"ý
î"'~
î"@ý
î"ý

Page 117
 391424375

î"ý
î"ý
î"ý
ï"'~
ï"@ý
ï"ý
ï"ý
ï"ý
ï"ý
ð"'~
ð"@ý
ð"ý
ð"ý
ð"ý
ñ"'~
ñ"@ý
ñ"ý
ñ"ý
ñ"ý
ò"'~
ò"@ý
ò"ý
ò"ý
ò"ý
ò" ý
ó"'~
ó"@ý
ó"!
ý
ó"!
ý
ó""ý
ó" ý
ô"'~
ô"@ý
ô"#ý
ô"#ý
ô"$ý
ô"%ý
ô"ßý
õ"'~
õ"@ý
õ"&ý
õ"&ý
õ"'ý
õ"(ý
ö"'~
ö"@ý
ö")ý
ö")ý
ö"*ý

Page 118
 391424375

ö"ý
÷
"'~
÷
"@ý
÷
"ý
÷
"ý
÷
"ý
÷
"sý
ø"'~
ø"@ý
ø"tý
ø"tý
ø"uý
ø"vý
ù"'~
ù"@ý
ù"wý
ù"wý
ù"xý
ù"yý
ú"'~
ú"@ý
ú"zý
ú"zý
ú"{ý
ú"|ý
ú"}ý
û"'~
û"@ý
û"~ý
û"ý
û"€ý
û" ý
ü"'~
ü"@ý
ü"ý
ü"ý
ü"‚ý
ü"ƒý
ý"'~
ý"@ý
ý"„ý
ý"„ý
ý"…ý
ý"†ý
þ"'~
þ"@ý
þ"‡ý
þ"ˆý
þ"‰ý

Page 119
 391424375

þ"Šý
ÿ 
"'~
ÿ 
"@ý
ÿ 
"‹ý
ÿ 
"‹ý
ÿ 
"Œ

ý
ÿ 
"×D
ÖlFTTFFbTFFFTbbTTTFFTTbTTTTTbTTTT

"'~
"@ý
"Žý
"Žý
"ý
"ý
"'~
"@ý
"‘ý
"‘ý
"’ý
"“ý
"'~
"@ý
"”ý
"”ý
"•ý
"–ý
"'~
"@ý
"—ý
"—ý
"˜ý
"™ý
"'~
"@ý
"šý
"šý
"›ý
"œý
"'~
"@ý
"ý
"ý
"žý
"Ÿý
"'~
"@ý
"ý
"ý

Page 120
 391424375

"¡ý
"¢ý
"'~
"@ý
"£ý
"£ý
"¤ý
"¥ý
"'~
"@ý
"¦ý
"¦ý
"§ý
"/ý
"'~
"@ý
"0ý
"0ý
"1ý
"2ý

"'~

"@ý

"3ý

"3ý

"4ý

"5ý
"'~
"@ý
"6ý
"6ý
"7ý
"5ý
"'~
"@ý
"8ý
"8ý
"9ý
":ý

"'~

"@ý

Page 121
 391424375

";ý

";ý

"<ý
"'~
"@ý
"=ý
"=ý
">ý
"5ý
"'~
"@ý
"?ý
"?ý
"@ý
"Aý
"'~
"@ý
"jý
"Ñý
"Bý
"'~
"@ý
"Cý
"Cý
"D
ý
"Eý
"F

þÿ 
ÿ 
ÿ 
þÿ 
ÿ 
ÿ 
#þÿ 
ÿ 
ÿ 
þÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 

"Gý
"'~
"@ý
"Hý
"Iý
"Jý
"Îý
"'~
"@ý
"Ký
"Ký
"Lý
"Mý
"'~
"@ý
"Ný
"Oý
"Pý

Page 122
 391424375

"Qý
"'~
"@ý
"Ný
"†ý
"Rý
"Sý
"'~
"@ý
"Tý
"Ný
"Uý
"Vý
"'~
"@ý
"Tý
"Tý
"Wý
"Vý
"'~
"@ý
"Xý
"Xý
"Yý
"¶ý
"'~
"@ý
"Zý
"Zý
"[ý
"¶ý
"'~
"@ý
"\ý
"\ý
"]ý
"^ý
"ßý
"'~
"@ý
"_ý
"`
ý
"aý
"bý
"'~
"@ý
"cý
"`
ý
"dý

Page 123
 391424375

"eý
"'~
"@ý
"fý
"fý
"gý
"¶ý
"'~
"@ý
"hý
"hý
"iý
"jý
"'~
"@ý
"ký
"ký
"lý
"m×D

lTTTTTTTTTTTTTFTTFpTTTTTTTTbTTTT
"'~
"@ý
"ný
"oý
"pý
"Îý
!
"'~
!
"@ý
!
"qý
!
"qý
!
"rý
!
"ý
"'~
"@ý
"qý
"ý
"ý
"ý
#"'~
#"@ý
#"ý
#"ý
#"ý
#"ý
#"ý
$"'~
$"@ý
$"
ý

Page 124
 391424375

$"
ý
$"ý
%"'~
%"@ý
%"ý
%"ý
%"
ý
%"ý
&"'~
&"@ý
&"ý
&"ý
&"ý
'"'~
'"@ý
'"ý
'"zý
'"ý
'"ý
("'~
("@ý
("ý
("ý
("ý
)"'~
)"@ý
)"ý
)"ý
)"ý
*"'~
*"@ý
*"ý
*"ý
*"ý
+"'~
+"@ý
+"ý
+"ý
+"ý
+"ý

-"'~

Page 125
 391424375

-"@ý
-"ý
-"÷
ý
-"ý
."'~
."ð?ý
."ý
."ý
."ý
."ý
/"'~
/"ð?ý
/"ý
/"ý
/"ý
/"ý
0"'~
0"@ý
0" ý
0"!
ý
0""ý
0"Öý
1"'~
1"@ý
1"×ý
1"×ý
1"Øý
1"Ùý
1"Úý
2"'~
2"@ý
2"Ûý
2"Ûý
2"Üý
2"Ýý
2"Úý
3"'~
3"@ý
3"Þý
3"Þý
3"ßý
3"àý
3"Úý
4"'~
4"@ý
4"áý
4"áý
4"âý
4"ãý

Page 126
 391424375

4"Úý
5"'~
5"@ý
5"äý
5"äý
5"åý
5"æý
5"ßý
6"'~
6"@ý
6"çý
6"çý
6"èý
6"G
ý
7"'~
7"@ý
7"H
ý
7"H
ý
7"I
ý
7"=ý
8"'~
8"@ý
8">ý
8">ý
8"?ý
8"@ý
9"'~
9"@ý
9"Aý
9"Aý
9"Bý
9"Cý
:"'~
:"@ý
:"D
ý
:"D
ý
:"Eý
:"¶ý
;"'~
;"@ý
;"Fý
;"Fý
;"Gý
;"Hý
<"'~

Page 127
 391424375

<"@ý
<"Iý
<"Jý
<"Ký
<"Lý
Err:501
Err:501
Err:501
Err:501
Err:501
Err:501
>"'~
>"@ý
>"Pý
>"ý
>"Qý
>"Rý
?"'~
?"@ý
?"Pý
?"Sý
?"Tý
?"R×D

lTTTbFTFTFFFTTFTTTbbbbbTTTTTTTTT@
@"'~
@"@ý
@"Uý
@"Sý
@"Vý
@"àý
A"'~
A"@ý
A"Uý
A"ý
A"Qý
B"'~
B"@ý
B"áý
B"áý
B"âý
B"ãý
B"ßý
C"'~
C"@ý
C"äý
C"äý
C"åý
C"æý
D
"'~

Page 128
 391424375

D
"@ý
D
"çý
D
"çý
D
"èý
D
"éý
E"'~
E"@ý
E"êý
E"êý
E"ëý
E"ìý
F"'~
F"@ý
F"íý
F"íý
F"îý
F"ïý
G"'~
G"@ý
G"ðý
G"ðý
G"ñý
G"òý
H"'~
H"@ý
H"óý
H"óý
H"ôý
H"õý
I"'~
I"@ý
I"öý
I"öý
I"÷
ý
I"øý
J"'~
J"@ý
J"ùý
J"ùý
J"úý
J"¶ý
K"'~
K"@ý
K"ûý
K"ûý
K"üý
K"ýý
L"'~
L"@ý

Page 129
 391424375

L"þý
L"ÿ 
ý
L"ý
L"Îý
M"'~
M"@ý
M"ý
M"ý
M"ý
M"ý
N"'~
N"@ý
N"ý
N"ý
N"ý
N"ý
N"ßý
O"'~
O"ð?ý
O"ý
O"ý
O"ý
O"ý
P"'~
P"@ý
P"
ý
P"Iý
P"ý
P"ý
P"žý
Q"'~
Q"ð?ý
Q"
ý
Q"
ý
Q"ý
Q"ý
Q"žý
R"'~
R"ð?ý
R"
ý
R"öý
R"ý
R"ý
R"žý
S"'~

Page 130
 391424375

S"ð?ý
S"
ý
S"ý
S"ý
S"ý
S"žý
T"'~
T"ð?ý
T"
ý
T"ý
T"ý
T"ý
T"žý
U"'~
U"ð?ý
U"
ý
U"
ý
U"ý
U"ý
U"žý
V"'~
V"ð?ý
V"
ý
V"ý
V"ý
V"ý
V"žý
W"'~
W"ð?ý
W"
ý
W"ý
W"ý
W"ý
W"žý
X"'~
X"ð?ý
X"
ý
X"ý
X"ý
X"ý
X"žý
Y"'~

Page 131
 391424375

Y"ð?ý
Y"
ý
Y"ý
Y"sý
Y"ý
Y"žý
Z"'~
Z"ð?ý
Z"
ý
Z"tý
Z"uý
Z"ý
Z"žý
["'~
["ð?ý
["
ý
["vý
["wý
["ý
["žý
\"'~
\"ð?ý
\"
ý
\"xý
\"yý
\"ý
\"žý
]"'~
]"ð?ý
]"
ý
]"zý
]"{ý
]"ý
]"žý
^"'~
^"ð?ý
^"
ý
^"|ý
^"}ý
^"ý
^"žý
_"'~
_"@ý

Page 132
 391424375

_"~ý
_"~ý
_"×D
Ò
lTFbTTTTTTTTTTTbTbbbbbbbbbbbbbbb`

`
"'~
`
"@ý
`
"€ý
`
"ý
`
"‚ý
a"'~
a"@ý
a"ƒý
a"ƒý
a"„ý
b"'~
b"@ý
b"…ý
b"†ý
b"‡ý
c"'~
c"@ý
c"ˆý
c"‰ý
c"Šý
d"'~
d"@ý
d"ˆý
d"ˆý
d"‹ý
e"'~
e"@ý
e"Œ

ý
e"Œ

ý
e"ý
f"'~
f"@ý
f"Žý
f"Žý
f"ý
g"'~
g"@ý
g"ý
g"éý
g"êý
g"»ý
h"'~
h"@ý
h"ëý
h"ëý

Page 133
 391424375

h"ìý
i"'~
i"@ý
i"íý
i"íý
i"îý
j"'~
j"@ý
j"ïý
j"ðý
j"ñý
j"òý
j"‘ý
j"’ý
k"'~
k"@ý
k"“ý
k"“ý
k"”ý
l"'~
l"@ý
l"•ý
l"•ý
l"–ý
m"'~
m"@ý
m"—ý
m"—ý
m"˜ý
n"'~
n"@ý
n"™ý
n"™ý
n"šý
o"'~
o"@ý
o"›ý
o"÷
ý
o"œý
p"'~
p"@ý
p"ý
p"ý
p"žý
q"'~
q"@ý
q"Ÿý
q"Ÿý
q" ý

Page 134
 391424375

r"'~
r"@ý
r"¡ý
r"¡ý
r"¢ý
s"'~
s"@ý
s"£ý
s"£ý
s"¤ý
t"'~
t"@ý
t"¥ý
t"¹ý
t"¦ý
u"'~
u"@ý
u"§ý
u"§ý
u"¨ý
v"'~
v"@ý
v"©ý
v"©ý
v"ªý
w"'~
w"@ý
w"«ý
w"«ý
w"¬
ý
x"'~
x"@ý
x"ý
x"ý
x"®


ý
y"'~
y"@ý
y"¯ý
y"¯ý
y"°ý
z"'~
z"@ý
z"±ý
z"±ý
z"²ý
{"'~
{"@ý
{"³ý
{"³ý

Page 135
 391424375

{"´ý
|"'~
|"@ý
|"µý
|"µý
|"¶ý
}"'~
}"@ý
}"·ý
}"·ý
}"¸ý
~"'~
~"@ý
~"¹ý
~"¹ý
~"ºý
"'~
"@ý
"»ý
"»ý
"¼ý
"½×D
†lFFFFFFFTFFpFFFFFFFFFFFFFFFFFFFF€
€"'~
€"@ý
€"¾ý
€"¿ý
€"Àý
€".ý
"'~
"@ý
"Á
ý
"Âý
"Ãý
‚"'~
‚"@ý
‚"Äý
‚"Äý
‚"Å
ý
‚"Æý
ƒ"'~
ƒ"@ý
ƒ"Çý
ƒ"Çý
ƒ"Èý
ƒ"Éý
„"'~
„"@ý
„"Êý
„"Êý

Page 136
 391424375

„"Ëý
…"'~
…"@ý
…"Ìý
…"Ìý
…"Íý
†"'~
†"@ý
†"Îý
†"Ïý
†"Ðý
‡"'~
‡"@ý
‡"Ñý
‡"Ñý
‡"Òý
ˆ"'~
ˆ"@ý
ˆ"Óý
ˆ"Ôý
ˆ"Õý
‰"'~
‰"@ý
‰"Öý
‰"Öý
‰"×ý
Š"'~
Š"@ý
Š"Öý
Š"Øý
Š"Ùý
‹"'~
‹"@ý
‹"Öý
‹"Ñý
‹"Úý
Œ

"'~
Œ

"@ý
Œ

"Ûý
Œ

"Ûý
Œ

"Üý
"'~
"@ý
"Ýý
"Ýý
"Þý
Ž"'~
Ž"@ý
Ž"ßý

Page 137
 391424375

Ž"ßý
Ž"¤ý
"'~
"@ý
"Iý
"öý
"Jý
"'~
"@ý
"Ký
"Lý
"Mý
‘"'~
‘"@ý
‘"Ný
‘"Ný
‘"Oý
’"'~
’"@ý
’"Pý
’"Pý
’"Qý
“"'~
“"@ý
“"Rý
“"Rý
“"Sý
“"Tý
”"'~
”"@ý
”"Uý
”"Uý
”"Vý
”"Wý
•"'~
•"@ý
•"Xý
•"÷
ý
•"Yý
–"'~
–"@ý
–"Zý
–"Zý
–"[ý
–"\ý
—"'~
—"@ý
—"]ý
—"]ý

Page 138
 391424375

—"^ý
—"üý
˜"'~
˜"@ý
˜"]ý
˜"Iý
˜"_ý
˜"`
ý
™"'~
™"@ý
™"aý
™"Iý
™"bý
™"cý
š"'~
š"@ý
š"]ý
š"Ñý
š"dý
›"'~
›"@ý
›"aý
›"aý
›"eý
›"cý
œ"'~
œ"@ý
œ"fý
œ"fý
œ"gý
œ"hý
"'~
"@ý
"iý
"÷
ý
"jý
ž"'~
ž"@ý
ž"ký
ž"ký
ž"lý
ž"üý
Ÿ"'~
Ÿ"@ý
Ÿ"mý
Ÿ"÷
ý
Ÿ"ný
Ÿ"ü×D
ölTFTTFFFFFFFFFFFFFFFTTFTTTTFTTFT
"'~

Page 139
 391424375

"@ý
"o ý
"o ý
"p ý
"ôý
¡"'~
¡"@ý
¡"õý
¡"õý
¡"öý
¢"'~
¢"@ý
¢"÷
ý
¢"÷
ý
¢"øý
£"'~
£"@ý
£"ùý
£"ùý
£"úý
£"ûý
¤"'~
¤"@ý
¤"üý
¤"üý
¤"ýý
¤"þý
¥"'~
¥"@ý
¥"ÿ 
ý
¥"ÿ 
ý
¥"ý
¥"ý
¦"'~
¦"@ý
¦"ý
¦"ý
¦"ý
§"'~
§"@ý
§"ý
§"ý
§"ý
¨"'~
¨"@ý
¨"ý
¨"ý
¨"ý
©"'~

Page 140
 391424375

©"@ý
©"ý
©"Iý
©"ý
ª"'~
ª"@ý
ª"
ý
ª"
ý
ª"ý
ª"ý
«"'~
«"@ý
«"
ý
«"
ý
«"ý
«"ý
¬
"'~
¬
"@ý
¬
"ý
¬
"ý
¬
"ý
¬
"ý
"'~
"@ý
"ý
"ý
"ý
"¶ý
®


"'~
®


"@ý
®


"ý
®


"ý
®


")ý
®


"*ý
¯"'~
¯"@ý
¯"+ý
¯"+ý
¯"
¯"-ý
°"'~
°"@ý
°".ý
°".ý
°"/ý

Page 141
 391424375

°"0ý
±"'~
±"@ý
±"1ý
±"1ý
±"2ý
²"'~
²"@ý
²"3ý
²"3ý
²"4ý
²"5ý
³"'~
³"@ý
³"ý
³"ý
³"6ý
´"'~
´"ð?ý
´"
ý
´"7ý
´"8ý
´"ý
´"žý
µ"'~
µ"ð?ý
µ"
ý
µ"9ý
µ":ý
µ"ý
µ"žý
¶"'~
¶"ð?ý
¶"
ý
¶";ý
¶"<ý
¶"ý
¶"žý
·"'~
·"ð?ý
·"
ý
·"=ý
·">ý
·"ý
·"žý

Page 142
 391424375

¸"'~
¸"ð?ý
¸"
ý
¸"?ý
¸"@ý
¸"ý
¸"žý
¹"'~
¹"ð?ý
¹"
ý
¹"Aý
¹"Bý
¹"ý
¹"žý
º"'~
º"ð?ý
º"
ý
º"Cý
º"D
ý
º"ý
º"žý
»"'~
»"ð?ý
»"
ý
»"Eý
»"Fý
»"ý
»"žý
¼"'~
¼"ð?ý
¼"Gý
¼";ý
¼"Hý
¼"Iý
¼"žý
½"'~
½"ð?ý
½"Gý
½"=ý
½"Jý
½"Iý
½"žý
¾"'~
¾"ð?ý
¾"Gý

Page 143
 391424375

¾"?ý
¾"Ký
¾"Iý
¾"žý
¿"'~
¿"ð?ý
¿"Gý
¿"Aý
¿"Lý
¿"Iý
¿"ž×D
8
lTFFTTTFFFFTTTTTTTFTFbbbbbbbbbbbÀ
À"'~
À"ð?ý
À"Gý
À"Cý
À"Mý
À"Iý
À"žý
Á
"'~
Á
"ð?ý
Á
"Gý
Á
"Eý
Á
"Ný
Á
"Iý
Á
"žý
Â"'~
Â"@ý
Â"Oý
Â"Oý
Â"Pý
Â"Qý
Ã"'~
Ã"@ý
Ã"Rý
Ã"Rý
Ã"Sý
Ã"Tý
Ã"Uý
Ä"'~
Ä"@ý
Ä"Vý
Ä"Wý
Ä"Qý
Ä"Xý
Å
"'~
Å
"@ý
Å
"Vý
Å
"Sý

Page 144
 391424375

Å
"Yý
Å
"Xý
Æ"'~
Æ"@ý
Æ"Zý
Æ"Zý
Æ"[ý
Æ"çý
Æ"ßý
Ç"'~
Ç"@ý
Ç"èý
Ç"èý
Ç"éý
È"'~
È"@ý
È"êý
È"÷
ý
È"ëý
É"'~
É"@ý
É"ìý
É"÷
ý
É"íý
Ê"'~
Ê"@ý
Ê"îý
Ê"÷
ý
Ê"ïý
Ë"'~
Ë"@ý
Ë"ðý
Ë"ðý
Ë"ñý
Ë"òý
Ë"ßý
Ì"'~
Ì"@ý
Ì"óý
Ì"óý
Ì"_ý
Ì"`
ý
Ì"aý
Í"'~
Í"@ý
Í"bý
Í"bý
Í"cý
Î"'~

Page 145
 391424375

Î"@ý
Î"dý
Î"dý
Î"eý
Ï"'~
Ï"@ý
Ï"fý
Ï"÷
ý
Ï"gý
Ð"'~
Ð"@ý
Ð"fý
Ð"fý
Ð"hý
Ð"gý
Ñ"'~
Ñ"@ý
Ñ"iý
Ñ"iý
Ñ"jý
Ò"'~
Ò"@ý
Ò"ký
Ò"ký
Ò"lý
Ò"mý
Ó"'~
Ó"@ý
Ó"ný
Ó"ný
Ó"oý
Ó"pý
Ô"'~
Ô"@ý
Ô"qý
Ô"qý
Ô"rý
Ô"!
ý
Õ"'~
Õ"@ý
Õ""ý
Õ""ý
Õ"#ý
Õ"$ý
Ö"'~
Ö"@ý
Ö"%ý
Ö"%ý
Ö"&ý

Page 146
 391424375

×"'~
×"@ý
×"'ý
×"'ý
×"(ý
Ø"'~
Ø"@ý
Ø")ý
Ø")ý
Ø"*ý
Ø"Ôý
Ù"'~
Ù"@ý
Ù"+ý
Ù"+ý
Ù"
Ù"-ý
Ú"'~
Ú"@ý
Ú".ý
Ú".ý
Ú"/ý
Ú"-ý
Û"'~
Û"@ý
Û"0ý
Û"0ý
Û"1ý
Û"2ý
Ü"'~
Ü"@ý
Ü"3ý
Ü"3ý
Ü"4ý
Ý"'~
Ý"@ý
Ý"5ý
Ý"5ý
Ý"6ý
Þ"'~
Þ"@ý
Þ"7ý
Þ"8ý
Þ"9ý
ß"'~
ß"@ý
ß":ý
ß"Iý
ß";ý

Page 147
 391424375

ß"Î×D
žlbbTbTTbFFFFbbFFFTFTTTTFFTTTTFFFà
à"'~
à"@ý
à":ý
à"Ñý
à"<ý
á"'~
á"@ý
á":ý
á":ý
á"=ý
á"Îý
â"'~
â"@ý
â">ý
â">ý
â"?ý
â"@ý
ã"'~
ã"@ý
ã"Aý
ã"Aý
ã"Bý
ã"Cý
ä"'~
ä"ð?ý
ä"D
ý
ä"D
ý
ä"Eý
ä"Fý
ä"ý
ä"žý
å"'~
å"@ý
å"Gý
å"Gý
å"Hý
æ"'~
æ"@ý
æ"Iý
æ"Iý
æ"Jý
ç"'~
ç"@ý
ç"Ký
ç"Ký
ç"Lý
ç"Mý
è"'~

Page 148
 391424375

è"@ý
è"Ný
è"Ný
è"Oý
è"ý
é"'~
é"@ý
é"ý
é"÷
ý
ê"'~
ê"@ý
ê"ý
ê"÷
ý
ë"'~
ë"@ý
ë"ý
ë"÷
ý
ì"'~
ì"@ý
ì"ý
ì"ý
ì"ý
í"'~
í"@ý
í"ý
í"÷
ý
î"'~
î"@ý
î"ý
î"ý
î"ý
ï"'~
ï"@ý
ï"ý
ï"ý
ï"ý
ï" ý
ð"'~
ð"@ý
ð"ý
ð"!
ý
ð""ý
ð"#ý
ñ"'~
ñ"@ý
ñ"$ý
ñ"$ý
ñ"%ý
ñ"œý

Page 149
 391424375

ò"'~
ò"@ý
ò"ý
ò"ý
ò"žý
ó"'~
ó"@ý
ó"Ÿý
ó"Ÿý
ó" ý
ô"'~
ô"@ý
ô"¡ý
ô"¡ý
ô"¢ý
õ"'~
õ"@ý
õ"£ý
õ"£ý
õ"¤ý
õ"¥ý
ö"'~
ö"@ý
ö"¦ý
ö"¦ý
ö"§ý
ö"¨ý
÷
"'~
÷
"@ý
÷
"©ý
÷
"©ý
÷
"ªý
ø"'~
ø"@ý
ø"«ý
ø"«ý
ø"¬
ý
ø"ý
ù"'~
ù"@ý
ù"®


ý
ù"®


ý
ù"¯ý
ù"¶ý
ú"'~
ú"@ý
ú"°ý
ú"°ý
ú"±ý

Page 150
 391424375

û"'~
û"@ý
û"²ý
û"²ý
û"³ý
ü"'~
ü"@ý
ü"´ý
ü"´ý
ü"µý
ü"¶ý
ý"'~
ý"@ý
ý"·ý
ý"·ý
ý"¸ý
ý"¹ý
þ"'~
þ"@ý
þ"ºý
þ"ºý
þ"»ý
þ"¼ý
ÿ 
"'~
ÿ 
"ð?ý
ÿ 
"½ý
ÿ 
"½ý
ÿ 
"¾ý
ÿ 
"¿ý
ÿ 
"ý
ÿ 
"ž×D
.lFTTTpFFTT888F8FTTTFFFTTFTTFFTTT

"'~
"@ý
"Àý
"Àý
"Á
ý
"'~
"@ý
"Âý
"Âý
"Ãý
"Äý
"'~
"@ý
"Å
ý
"Å
ý
"Æý

Page 151
 391424375

"Çý
"'~
"@ý
"Èý
"Èý
"Éý
"'~
"@ý
"Êý
"Êý
"Ëý
"Ìý
"'~
"@ý
"Íý
"Iý
"Îý
"Îý
"'~
"@ý
"Íý
"Íý
"Ïý
"Îý
"'~
"@ý
"Íý
"Ñý
"Ðý
"'~
"@ý
"Ñý
"Iý
"Òý
"Îý
"'~
"@ý
"Ñý
"Ñý
"Óý
"Îý

"'~

"@ý

"Ñý

"Ñý

Page 152
 391424375

"Ôý
"'~
"@ý
"Õý
"Iý
"Öý
"Îý
"'~
"@ý
"Õý
"Õý
"×ý
"Îý

"'~

"@ý

"Õý

"Ñý

"Øý
"'~
"@ý
"Ùý
"Iý
"Úý
"Îý
"'~
"@ý
"Ùý
"Ùý
"Ûý
"Îý
"'~
"@ý
"Ùý
"Ñý
"Üý
"'~
"@ý
"Ýý
"Iý
"Þý
"Îý
"'~
"@ý

Page 153
 391424375

"Ýý
"Ýý
"ßý
"Îý
"'~
"@ý
"Ýý
"Ñý
"àý
"'~
"@ý
"áý
"Iý
"âý
"Îý
"'~
"@ý
"áý
"áý
"ãý
"Îý
"'~
"@ý
"áý
"Ñý
"äý
"'~
"@ý
"åý
"Iý
"æý
"Îý
"'~
"@ý
"åý
"åý
"aý
"Îý
"'~
"@ý
"åý
"Ñý
"bý
"'~
"@ý
"cý
"Iý
"dý
"Îý

Page 154
 391424375

"'~
"@ý
"cý
"cý
"eý
"Îý
"'~
"@ý
"cý
"Ñý
"fý
"'~
"@ý
"gý
"gý
"hý
"'~
"@ý
"iý
"™ý
"jý
"'~
"@ý
"ký
"™ý
"l×D
JlFTTFTTTFTTFTTFTTFTTFTTFTTFTTFFF
"'~
"@ý
"ký
"ký
"mý
!
"'~
!
"@ý
!
"ný
!
"™ý
!
"oý
"'~
"@ý
"pý
"pý
"qý
#"'~
#"@ý
#"rý
#"sý
#"tý
$"'~
$"@ý
$"uý

Page 155
 391424375

$"uý
$"vý
$"ˆý
%"'~
%"@ý
%"wý
%"wý
%"xý
%"yý
&"'~
&"@ý
&"zý
&"zý
&"{ý
&"|ý
'"'~
'"@ý
'"}ý
'"}ý
'"~ý
'"ý
("'~
("@ý
("€ý
("€ý
("ý
("‚ý
)"'~
)"@ý
)"ƒý
)"ƒý
)"„ý
*"'~
*"@ý
*"…ý
*"…ý
*"†ý
*"‡ý
+"'~
+"@ý
+"ˆý
+"ˆý
+"‰ý

Page 156
 391424375

-"'~
-"@ý
-"ý
-"Žý
-"ý
-"˜ý
."'~
."@ý
."~
."âšrý
."ý
."˜ý
/"'~
/"@ý
/"Žý
/"ý
/"‘ý
/"’ý
0"'~
0"@ý
0"“ý
0"”ý
0"•ý
0"Îý
1"'~
1"@ý
1"“ý
1"–ý
1"—ý
1"Îý
2"'~
2"@ý
2"˜ý
2"˜ý
2"™ý
3"'~
3"@ý
3"µý
3"µý
3"¶ý
4"'~
4"@ý
4"·ý
4"·ý
4"¸ý
5"'~
5"@ý

Page 157
 391424375

5"¹ý
5"Iý
5"ºý
5"Îý
6"'~
6"@ý
6"¹ý
6"¹ý
6"»ý
6"Îý
7"'~
7"@ý
7"¹ý
7"Ñý
7"¼ý
8"'~
8"@ý
8"½ý
8"½ý
8"¾ý
9"'~
9"@ý
9"¿ý
9"¿ý
9"Àý
9"üý
:"'~
:"@ý
:"Á
ý
:"Âý
:"Ãý
;"'~
;"@ý
;"Äý
;"Äý
;"Å
ý
;"øý
<"'~
<"@ý
<"ùý
<"ùý
<"úý
<"ûý
Err:501
Err:501
Err:501
Err:501
Err:501
>"'~

Page 158
 391424375

>"@ý
>"þý
>"ÿ 
ý
>"ý
?"'~
?"@ý
?"ý
?"ý
?"½
×D
JlFFFFTTTTTFTFpTTTTTFFFTTFFTFTTFF@
@"'~
@"@ý
@"¾
ý
@"¾
ý
@"¿
ý
A"'~
A"@ý
A"À
ý
A"À
ý
A"Á

ý
B"'~
B"ð?ý
B"Gý
B"Iý
B"Â
ý
B"Iý
B"žý
C"'~
C"ð?ý
C"Gý
C"
ý
C"Ã
ý
C"Iý
C"žý
D
"'~
D
"@ý
D
"Gý
D
"öý
D
"Ä
ý

Page 159
 391424375

D
"Iý
D
"žý
E"'~
E"ð?ý
E"Gý
E"ý
E"Å

ý
E"Iý
E"žý
F"'~
F"ð?ý
F"Gý
F"Gý
F"Æ
ý
F"Iý
F"žý
G"'~
G"ð?ý
G"Gý
G"Ç
ý
G"È
ý
G"Iý
G"žý
H"'~
H"ð?ý
H"Gý
H"ý
H"É
ý
H"Iý
H"žý
I"'~
I"ð?ý
I"Gý
I"ý
I"Ê
ý
I"Iý
I"žý
J"'~
J"ð?ý
J"Gý
J"ý
J"Ë
ý

Page 160
 391424375

J"Iý
J"žý
K"'~
K"ð?ý
K"Gý
K"ý
K"Ì
ý
K"Iý
K"žý
L"'~
L"ð?ý
L"Gý
L"tý
L"Í
ý
L"Iý
L"žý
M"'~
M"ð?ý
M"Gý
M"vý
M"Î
ý
M"Iý
M"žý
N"'~
N"ð?ý
N"Gý
N"9ý
N"Ï
ý
N"Iý
N"žý
O"'~
O"ð?ý
O"Gý
O"xý
O"Ð
ý
O"Iý
O"žý
P"'~
P"ð?ý
P"Gý
P"zý
P"Ñ
ý
P"Iý

Page 161
 391424375

P"žý
Q"'~
Q"ð?ý
Q"Gý
Q"|ý
Q"Ò
ý
Q"Iý
Q"žý
R"'~
R"@ý
R"Ó
ý
R"Ó
ý
R"Ô
ý
S"'~
S"@ý
S"Õ
ý
S"÷
ý
S"Ö
ý
T"'~
T"@ý
T"Õ
ý
T"Õ
ý
T"×
ý
T"Ö
ý
U"'~
U"ð?ý
U"ý
U"sý
U"Ø
ý
U"×0˜¤FFbbbbbbbbbbbbbbbbFFT>¶9@ÈÈ@

ï7
Å
=ÌÈÀOI;g
dü©ñÒMbP?_*+‚€%ðÁ
ƒ„¡"ðà?à?U
}ª/#}Õ#}€%#}* #Oð$ð’$€ð ’ÿ 
Ïð0Ò(OððÃð“ð“ð ðÐHÂ
ðõðõð`
“
ðp“ðððõðõð¤¼ð¤¼ðððð”ðГˆðГðð“ðõý

Page 162
 391424375

#—~
#T@ý
#˜ý
#Tý
#™~
#Px@ý
#šý
#°ý
#›~
#°{@ý
#šý
#Uý
#œ~
#àƒ@ý
#šý
#°ý
#~
#Ä—@ý
#žý
#Vý
#Ÿ~
#Ø—@ý
#ý
#Vý
#¡~
#œ˜@ý
#ý
#Wý
#¢~
#x™@ý
#£ý
#Xý
#¤~
#”š@ý
#¥ý
#°ý
#¦~
#P›@ý
#šý
#Yý

#¦~

#h›@ý

#šý

#Yý
#¦~

Page 163
 391424375

#@œ@ý
#šý
#Yý
#¦~
#D
œ@ý
#šý
#Yý

#§~

#Hœ@ý

#¨ý

#°ý
#©~
#˜œ@ý
#¢ý
#Xý
#ª~
#œœ@ý
#¨ý
#°ý
#«~
#èœ@ý
#¨ý
#°ý
#¬
~
#h @ý
#ý
#Zý
#~
#b£@ý
#ý
#[ý
#®


~
#d£@ý
#ý
#[ý
#¯~
#©@ý
#šý
#°ý
#±~
#Ê©@ý
#šý
#°ý
#²~
#ª@ý

Page 164
 391424375

#šý
#\ý
#³~
#’ª@ý
#šý
#°ý
#´~
#Z«@ý
#š×<š88888888888888888888**8* ð$!
ð’$€#ð ’ÿ 
Ï$ð0Ò(O&ð'ðÃ(ð“)ð“*ð+ðÐHÂ
#°ý
!
#µ~
!
#"¬
@ý
!
#šý
##°ý
$#¶~
$#ê¬
@ý
$#šý
&#°ý
'#·~
'#@¯@ý
'#šý
'#]ý
(#5~
(#B¯@ý
(#šý
(#]ý
)#6~
)#D
¯@ý
)#šý
)#]ý
*#œ~
*#~¯@ý
*#šý
*#°ý
+#™~
+#€¯@ý
+#šý
+#°ý

-#8~
-#1±@ý
-#šý
-#°ý
.#›~
.#[±@ý
.#šý

Page 165
 391424375

.#Uý
/#9~
/#\±@ý
/#šý
/#]ý
0#:~
0#6²@ý
0#:ý
1#:~
1#–²@ý
1#:ý
2#:~
2#—²@ý
2#:ý
3#:~
3#™²@ý
3#:ý
4#:~
4#œ²@ý
4#:ý
5#:~
5#ž²@ý
5#:ý
6#:~
6#Ÿ²@ý
6#:ý
7#;~
7#|µ@ý
7#<ý
7#°ý
8#=~
8#¸µ@ý
8#>ý
8#°ý
9#=~
9#̵@ý
9#?ý
9#°ý
:#@~
:#s·@ý
:#šý
:#°ý
;#A~
;#Ô·@ý
;#šý
;#°ý
<#B~
<#8¸@ý
<#šý

Page 166
 391424375

<#°ý
Err:501
Err:501
Err:501
Err:501
>#D
~
>#X»@ý
>#šý
>#°ý
?#E~
?#¼»@ý
?#šý
?#°×@ìD
**888888888*******88888888@ð$Að’$€Bð ’ÿ 
ÏCð0Ò(OD
ðEðÃFð“Gð“HðIðÐHÂJðõKðõLð`
“Mðp“Nðý
@#F~
@# ¼@ý
@#šý
@#°ý
A#G~
A#M½@ý
A#šý
A#°ý
B#H~
B#a¾@ý
B#šý
B#Uý
C#I~
C#c¾@ý
C#šý
C#]ý
D
#J~
D
#G¿@ý
D
#šý
D
#°ý
E#K~
E#¿@ý
E# ý
E#Zý
F#L~
F#\Á
@ý
F#Mý
F#°ý
G#L~
G#€\Á
@ý
G#Mý
G#°ý
H#N~
H#”Á
@ý
H#šý
H#°ý

Page 167
 391424375

I#O~
I#‡Ã@ý
I#šý
I#°ý
J#P~
J#XË@ý
J#šý
J#°ý
K#Q~
K#LÍ@ý
K#Qý
K#°ý
L#Q~
L#MÍ@ý
L#Qý
L#°ý
M#Q~
M#NÍ@ý
M#Qý
M#°ý
N#R~
N#|å@ý
N#¨ý
N#°×"t88888888888888>¶@ÈÈ@%%%ï7
Å
=ÌÈÀ?Q'y3
dü©ñÒMbP?_*+‚€%ðÁ
ƒ„¡"ðà?à?U
}U}ª}€}€}*}}€}U}€}
* ?ð@$ð’@$€ð ’@ÿ 
Ïð0Ò@(Oð@ð@Ãð“@ð“@ð@ ðÐ@HÂ
ð@õð@õð`
“@
ðp“@ð@ð@ð@õð@õð¤¼@ð¤¼@ð@ð@ð@ð”@ðГ@ˆðГ@ðð“@ð@õð”@ð@ˆ…ðP”@ð@ý
åý
æý
çý
èý
éý
êý
ëý
ìý
íý
îý

ïý
Gý
ð¾ý
ñ
ý
Gý
ò¾ý
ñ¾

Page 168
 391424375

ý
Gý
ó¾ý
ñ¾

ý
Gý
ô¾
ý
ñ¾
ý
Gý
õ¾ý
ñ¾

ý
Gý
öý
ñ¾
ý
Gý
÷
¾ý
ñ
ý
Gý
ø¾ý
ñ¾

ý
ý
ùý
ñ¾
ý

ú¾
ý

ñ¾

ý
ý
û¾ý
ñ¾

Page 169
 391424375

ý
ý
ü¾ý
ñ¾

ý¾

ñ¾

ý
ý
þ¾ý
ñ
ý
ý
ÿ 
¾ý
ñ
ý
ý
¾ý
ñ¾

ý
ý
ý
ñ¾
ý
ý
¾ý
ñ
ý
ý
¾ý
ñ¾

ý
ý
¾ý
ñ¾

ý
ý

Page 170
 391424375

¾ý
ñ¾

ý
ý
¾ý
ñ¾

ý
òý
¾ý
ñ¾

ý
Rý
¾
ý
ñ¾
ý
Rý
¾ý
ñ
ý
Gý

¾ý
ñ
ý
Gý
¾ý
ñ
ý
Gý
¾ý
ñ
ý
Gý

¾ý
ñ
ý
Gý
ý
ñ¾
ý
Gý
ý
ñ¾
×D
úlšRTTTTRRTRTTTTJJTJJTTTTTTLJRRRR ð@$!
ð’@$€"ð ’@ÿ 
Ï#ð0Ò@(O$ð@%ð@Ã&ð“@'ð“@(ð@)ðÐ@HÂ*ð@õ+ð@

Page 171
 391424375

Gý
¾ý
ñ¾

ý
!
Gý
!
¾!
ý
!
ñ¾
!
!

ý
Gý
¾"ý
ñ"
ý
#Gý
#¾#ý
#ñ##
ý
$Gý
$¾$ý
$ñ$
ý
%Gý
%¾
%ý
%ñ¾% %
ý
&Gý
&¾&ý
&ñ&
ý
'Gý
'¾'ý
'ñ''
ý
(Gý
(¾
(ý
(ñ¾( (
ý
)Gý
)¾)ý
)ñ))
ý
*Gý
*¾*ý
*ñ*
ý
+Gý

Page 172
 391424375

+¾
+ý
+ñ¾+ +
ý

ý
-Gý
-¾-ý
-ñ-
ý
.Gý
.¾.ý
.ñ.
ý
/Gý
/¾/ý
/ñ/
ý
0Gý
0¾
0ý
0ñ¾0 0
ý
1Gý
1!
¾1ý
1ñ1
ý
2Gý
2"¾2ý
2ñ2
ý
3Gý
3#¾3ý
3ñ¾
33
ý
4Gý
4$¾4ý
4ñ4
ý
5Gý
5%¾
5ý
5ñ¾5
ý
6Gý
6&¾6ý

Page 173
 391424375

6ñ¾6
ý
7Gý
7'7ý
7ñ¾7
ý
8aý
8(ý
8ñ¾8
ý
9aý
9)ý
9ñ¾9
ý
:ý
:*:ý
:ñ¾:
ý
;ý
;+;ý
;ñ¾;
ý
<ý
<
<ñ¾<
ý
Err:501
Err:501
Err:501
ý
>åý
>æý
>çý
>èý
>éý
>êý
>ëý
>ìý
>íý
>îý
>
ï×B.XTTRRLTJRTRJTLJJLTLLTLNNLD
D
LLNN>¶ @ÈÈ@
777ï7
þÿ 
ÿ 
ÿ 
þÿ 
ÿ 
ÿ 
þÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 

à…ŸòùOh«‘+'³Ù0ÀHP\pˆ
¬
¸'Paul WrightRyan CorvettiMicrosoft Excel@€32’Æ@€YGµžôÆþÿ 

ÕÍÕœ.“—+
Œ

'NGSOracleHardeningGuideV3VulnerabilitiesPatchesdefaultpasswordsdefaultportsfororaclePLSQLVULNSCPUWorksheets
Xÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 


Page 174
 391424375

ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 


-./0123456789:;<=>?@ACýÿ 
ÿ 
ÿ 
D
EFGHIJKLMNOPQRSTUVWXYZ[\]^_`
abcdefghijklmnopqrstuvwxyz{|}~ €Rÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
 ÀFâ.«Q

##0_);\("$"#

Ìÿ 
Ìÿ 
™ÿ 
fff™–––3f3™f333™3™3f33™333\ÿ 
ÿ 
ÿ 
`
…!
JOracleHardeningGuideV3…¯ùVulnerabilitiesPatches…o

HIPAA and GLB act require the ability to audit to Row Level sensitive data.}If the listener.ora is the main point of Listener conf

e not stopped by the Listener but it can log them if logging is enabled.set:
source IP addresses can connect to the listener.–set protocol.ora in 8i and sqlnet.ora in 9i/10g:

etc)
etc)
it has several ANY privsENI05A92C0958AFBCBCRENI is a schema account from Oracle Applications. D
efault it has several ANY privs
Find on Solaris or explorer search on Windows to find nefarious copies of listener.ora and sqlnet.ora.

ontained a column of valid_users:

eful to allocate a business process owner so that could be responsible for removing leaving accounts and checking this has been done in O
1526EThese default ports are well known and it is easy to change the port.(Change the port using listener.ora file.(Change th

up which is a business decision. Need to have more than one person but not much more. Users that do not need complete power should a
L runs quicker so development team may require this functionality.
. This should be a rare occurance and therefore not take up too much itme.Audit external tables Save archivelog files to diskFLocate archiv

TMPD
IR and TEMPKmkdir /u01/temp

608CF13718CD
C81090RE933B9A9475E882A6REP_MANAGER2D
4B13A8416073A1REP_OWNER88D
8F06915B1FE30BD
99EC2D
D
84E

Page 175
 391424375

type_name

0_SSO882B80B587FCD
BC8@PORTAL30_SSO is the schema owner of Oracle Portal Single-Sign onPORTAL30_SSO_AD
MINBD
E248D
4

om Oracle Applications. D
efault it has several CREATE privileges.PSB28EE1E024FC55E66[PSB is a schema account from Oracle Applicat
ublic account of Oracle9iAS Syndication Server.OSSAQ_SUBHOSSAQ_SUB is an administrative account of Oracle9iAS Syndication Serve

TAL31D
373ABE86992BE68.PORTAL31 is the schema owner of Oracle Portal.PORTAL30_AD
MIN7AF870D
89CABF1C7

in order to allow complete Point In Time recovery the database should be in ARCHIVELOG mode which means that the redo
cted.gNot aware of any good reasons not to do this. D
isk space is a bad reason given the fall in disk prices.92776EA17B8B5555[XNM is a
Unauthorized Access Vulnerabilities in Oracle E-Business Suite
om Oracle Applications. D
efault it has several ANY privsECX0A30645183812087[ECX is a schema account from Oracle Applications. D
efau

fuzzing and buffer overflows it is a good idea to give minimal pr

ers who can change the auditÅ
Auditing is a sensitive subject especially when auditing privileged users.
query shows users with audit privileges.
privilege

backup and purge the audit trail´If have to audit to sys.aud$ then can use auditing to protect the audit.
RLS and label securitywCredits: Thanks to D
avid Litchfield and Pete Finnigan as well as all the SANS oracle security team le
Syslog
s critical then it is justified.?Not difficult to do as just issue this command.
ut in place.Audit use of all ÚAuditing create session would be used to catch the time that users logon and off. It would generate a lot of aud
drop
rom Oracle or SQL Tools which is a free client. http://www.sqltools.net/ The audit logs are easily readable via a view called dba_audit_trail
s in the D
B. Aslong as redo logs are being archived off the databases state can always be inspected using Logminer https://www.giac.org/c
in all but a completely trusted network environment.host based ID
S`
a process list can show programs that are not meant to be running. One
default_directory_name from dba_external_tables;

Page 176
 391424375

privilege from dba_tab_privs where table_name='D
ATA_FILE_D
IR';

name from dba_source where text like'%wrapped%';

name from dba_source where text not like'%wrapped%';[IBP is a schema account from Oracle Applications. D
efault it has sev
database the latest CPU should be installed on test machines and then on the production machines unless it breaks current applications. Th
g websites that may have new Oracle security information of which there are many such as bugtraq and packetstorm.

og in without oracle authentication. This can be hacked easily from a non windows machine as it relies on the way that the username is form
356.htm2Audit software/admin tools accessing the database¥Assign a specific account for applications like Toad so that it can be locked do
opment work should have stopped then there may have been unauthorised access.*ad-hoc queries against production databasetest and d
erate databases. VPD
configuration is done using D
BSM_RLS.
15.06.015.06.025.06.035.07.015.07.025.07.035.07.045.07.055.08.015.08.025.09.016.00.006.01.016.01.026.01.036.01.046.01.056.01.066.
g is parsed as SQL.

so should only be done on internal applications with permisssion in writing.ŠThis process is difficult to do automatically and if there is a lot o
PLSQL D
eveloper
d be to hide the mathematical calculation that is used to gain a result which is passed back.ÄChecksumming all the objects in the database

privilege from dba_sys_privs where privilege in ('ALTER SYSTE

ld be owned by Oracle account
bership checked and recorded.OTHER group was able to edit the binaries used to run oracle then a denial of service could be easily moun

Page 177
 391424375

write and execute .Idbms_utility.get_hash_value can be used to get a hash value of a package.áOEM is very functional but its
ection should be made over SSH. If the connection is permanent then setting up an IPSEC tunnel would be a more practicable solution. The
be broken if attacker has the hash) but it does not encyrpt the data.
bomb or flooding it is wise to have off site backup which must

etely. OID
seems to be preferred route.fThe Oracle Listener is controlled by the LSNRCTL utility which previous to 10g allowed remote adm
to be done locally by editing the Listener.ora file at the OS.¯Minimum passworded Listener and very preferably should be Admin Restriction
ner_Security.pdf
Use a firewall to protect the Oracle server
D
isable remote login password file parameter€This parameter is set to NONE prior to 8.1.7 and EXCLUSIVE after that. It shou
over SSH is preferred admin tool.<Audit saved passwords in the tools which may be encrypted weakly. Should be deleted. Also the accoun
s on production servers.sstop the http server
oradebug and via dbms_java. It would be preferable to remove these but not always possible so remove all privileges to them
Be careful to sanitise data for external useWIt is worth having
tes the process of scanning for vulnerabilities through an enterprise..Use metalink to source the patch
ility.get_hash_value.
e default accounts need to be audited for which can be done using products such as NGS SQuirreL for oracle which has over a 1000 entrie

ed. Check users database passwords 6ALTER USER defaultaccount PROFILE myprofile;

value from v$parameter where name like '%arch%';áThe redo logs are a record of the SQL commands needed to return the d
with a default password. 10g release 1 and 2 are improving the security of these accounts by locking the default ones but they still come wit
'SYSTEM'

table_name

table_name

'ROLE'

tab_privs. Prioritise the others first and then prioritise SYS owned objects and objects that have known vulnerabilities."Set up profiles for da
that can be set and will increase security are:

Page 178
 391424375

wer of the account and security context of the environment being used. D
BA accounts should cut out more quickly and have less sessions p
SON4A0A55000357BB3ECD
to the $ORACLE_HOME/otrace/admin directory of your

s it uses can grow to be very large.MThe datafiles (.dbf) hold the actual persistent data and need to be protectedæThe database file locatio
value from v$parameter where name='control_files';
permisssions should be 660.Regulary audit Oracle log files”In order to recognise suspicious activity in the database the dba should monito

Revoke all from PUBLIC that's not needed 1D
BSNMP can read

. This will require some kind of failover secondary server if 24/7 is required.
hout the redo logs and so these should be mirrored.Å
Mirroring simply involves making a copy of the redo log which can be done by Oracle
ata can be recovered from hard drives using forensics techniques both at the OS layer and D
B layer.ÍUse secure delete software to wipe th
the location of the trace directories
alter and delete files and so needs to be controlled tightly.mselec
ld be checked and if not needed should be revoked completely.XBusiness decision as to what Java permissions are required if Java is bein

which may be

reuse

as one of the fastest.

INTERNAL and users granted SYSD
BA/SYSOPER have their passwo

'TABLE')

Page 179
 391424375

uditor should not view the passwords depending on privacy policy.

default_tablespace
plication account has been granted.Batch processesGBatch processes should access the database through one specific account€By enabli

mission. On 8i it can become admin by using dbms_repcat_admin.OWACA5D
67CD
878AFC49

01D
1OWNER5C3546B4F9165300OZF970B962D
942D
0C75[OZF is a schema account from Oracle Applications. D
efault it has several CRE
TEST_USERC0A0F776EBBBB7FBTESTPILOTD
E5B73C964C7B67D

5FETSD
EV29268859446F5A8CTSUSER90C4F894E2972F08TURBINE76F373437F33F347UD
D
ISYS@UD
D
ISYS is an administrative ac
CD
04VRR1811C49394C921D
66VRR23D
703795F61E3A9A3D
A1893A5FCA23BFWEBCAL01C69573E9D
EC14D
50WEBD
BD
4C4D
CD
D
4
D
EMO8 is some kind of demonstration account.D
EMO9EE025
46D
C27700F2AD
E28^D
IANE is an account to demonstrate AOLServer. It should not exist in a production environment.D
IPCE4A36B8E06C
everal CREATE privileges.ORACACHE5A4EEC421D
E68D
D
D
38E38619A12E0257ORAD
BA
ssouri-Rolla.ORANGE3D
9B7E34A4F7D
4E9OR SolutionsORAPROBE2E3EA470A4CA2D
943User used to execute default password check
SNMP Vulnerability in Oracle Enterprise Manager

Buffer Overflow Vulnerability in Oracle E-Business Suite Rev 1

es and passwordUThe users environment may contain usernames and passwords to make scripts work easilyÀit is possible to read a users

OSOPER groups and ORACLE user have been doing. OCITESTC09011CB0205B347OCM_D
B_AD
MINROCM_D
B_AD
MIN

COMMON59BBED
977430C1A8<OD
SCOMMON is a user with acces to Oracle Internet D
irectory.OE9C30855E7E0CB02D
62FAD
F01C4D
C
a schema account from Oracle Applications. D
efault it has several CREATE privileges.MFGFC1B0D
D
35E790847RMFG is a schema acco
n Services from the University of Missouri-Rolla.NOM_UTILISATEURMOT_D
E_PASSEFD
621020564A4978
6558AEOAIHUB902:OAIHUB902 is an account of Oracle 9iAS InterConnect (OAI).
KWALKER is a schema owner of Workflow IasdbL2LD
EMO0A6B2
94BAD
2AF80HThe account MD
SYS (Oracle Spatial administrator) has D
BA-like privilegesMEE5436F7169B29E4D
§There may be teething
segment_name

if they grow and cause a D
oS especially if the objects are < owned by privileged users.Resources used by the database¤Resources can b

RACLE may need it as well as OSD
BA and OSOPER. It should be limited below these users.8Restrict shell history files for usernames and

Network Configuration File:

Page 180
 391424375

nded by setting this parameter>set ORA_ENCRYPT_LOGIN to TRUE

en space is an issue deleting logs of a certain age so that there is rotation. It is worth correlating with SYSOG and ID
S logs using timestam

value from v$parameter where name like '%dump_dest%';

to oracle support in an insecure manner. This input should be sanitised before sending to Oracle support.RA perl script could be used to pa
ns so only Oracle can use them.ls -al device/disk/volumegif using veritas volume manager or similar then will have to use the tools supplied
ocal port (Oracle Notification Service remote port 'Oracle9iAS Clickstream Collector Agent Java Object Cache port D
CM Java Object Cache

1526 default listener which should be changed. Please check the

Oracle Application Server / Oracle D
atabase Oracle Net Listener Oracle D
atabase
Oracle Intelligent Agent $Enterprise Manager Servlet port SSL Oracle Enterprise Manager 'Oracle Connection Manager Admin (CMAN) Ente
Oracle Applications. D
efault it has several CREATE privileges.BUG_REPORTSE9473A88A4D
D
31F2From a bookCALVINHOBBES34200F9
abase.<INVALID
>Anonymous
40E871070APPLSYSFE84888987A6BF5AaAPPLSYS is an administration account for Oracle Applications. It controls the Concurrent Man
s an account for Oracle Applications. It has UNLIMITED
TABLESPACE.A5E09E84EC486FC9D
728438E8A5925E0—APPS is an often used
link$ and dba_users view allow access to the password hashes which in combination with the username makes decrypting th

efault it has several CREATE privileges.GMSE654261035504804[GMS is a schema account from Oracle Applications. D
efault it has severa

-./0123456789:;<=>?@ABCEýÿ 
ÿ 
ÿ 
FGHIJKLMNOPQRSTUVWXYZ[\]^_`
abcdefghijklmnopqrstuvwxyz{|}~ € has amongst other

.1848F0A31D
1C5C62AHL7910AE63C9F7EEEEAHM33C2E27CF5E401A4AK8FCB78BBA8A59515SAK is a schema account from Oracle
es.HXT169018EB8E2C4A77[HXT is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IBA0BD
475D
5B
gent agent to work which may be a factor in keeping this privilege IF the Intelligent agent functionality is to be kept.This package can be use

vs can be assigned more precisely so revoking ANY privileges should be enforced strongly. The D
BA role and SYS user will have this privil

er to move from machine to machine. PUBLIC does not require these privileges.%REVOKE EXECUTE ON UTL_TCP FROM PUBLIC&REV

Page 181
 391424375

controlled and in the future deprecated.)External tables are a link to the OS which allow database user to modify OS file and

privilege from dba_tab_privs where table_name ='INITJVMAUX';

e package being used less critical.{SELECT * FROM all_directories; and

Check date / time stamps on database objectsVEnsure reports and alerts are in place to deal with irregularities found through
Use a firewall to protect the Oracle server.$Audit Oracle client file permissions(Audit client configuration file contents8D
iscove

s also the trick of adding parameters at a the very bottom of an extended init.ora file which may not show when a text editor is used.9Check
privilege

User must have SELECT to D
ELETE and UPD
ATE.Check for SQL92_security TSELECT * FROM v$parameter where name

sers+Audit access to all dba and sys owned viewsRevoke SELECT ANY TABLE ™This SQL will list all parameters:

'_'
licitly declare hidden parameters so that they are known. For example _system_trib_enabled set to FALSE will switch off all SYSTEM trigge
ned by another user within it because if the object grows in size it may cause an denial of service on the application . Autoextensible tablesp

g a trigger. Triggers should be audited in order to find triggers in a schema owned by someone else.¾This query will find triggers not owned
trigger_name
password from sys.link$;

server but as the connection is made MTS allocates a new server port for that connection. This will be blocked by most firewalls so one solu
e handle a change of port number.

Page 182
 391424375

Configure product user profile for iSQL*Plus'Restrict databases that can be accessed'D
isable iSQL*Plus on production server
table_name
privilege

dba_users

s should be allowed to have EXTERNAL passwords.

counts only when neededAudit query tool privilegesEncrypt critical data1Audit generated applications for known weaknesses4Audit public l

grantee

privilege

ANT" privileges allow the grantee to pass on the privilege to any other user. This should be avoided and monitored.¿select grantee

privilege

'SYS'
and so should audited in case unauthorised users have them.cbusines processs required to match the allocation of system privileges to th

should be seperated in this manner.JSELECT * FROM v$parameter where name ='os_authent_prefix';

segment_name

or objects from other users which are out of place.cthis is most powerful role and should not be widely used so check for users and roles tha

Page 183
 391424375

privilege

S from the database and from the Listener remotely if enabled which it is by default. This is inherently insecure and additionally NGS has fou

roles SELECT_CATALOG_ROLE

granted_role

'EXECUTE_CATALOG_ROLE'
privilege

'D
BA_SYS_PRIVS'
'ROLE_ROLE_PRIVS');
D
BA users. Unauthorised access should be revoked. D
atabase in archivelog mode?Å
This query is for general parameter values.

.’Ports 2100 and 8080 were added to 9iR2 as part of the XD
B server and represent an additional attack surface which if not needed should

Page 184
 391424375

needed but try to avoid Extproc if possibly can.

table_name

table_name

text varchar2(20)

text) values (1

a.text from sys.ttt a join

Page 185
 391424375

text) values (2
med new D
BA account will help to secure the database from unauthorised privileged access.‰Note that SYS AS SYSD
BA cannot be locked

CREATE privileges.ASG1EF8D
8BD
87CF16BEæThis query will select the users and roles that can select the hashes.

'D
BA_USERS'))

'SELECT ANY TABLE'))

'OLAP_D
BA'

privilege

privilege

privilege

granted_role

ntifying the sensitive objects and seeing who has privileges on them rather than this method which looks at everything an individual can see
y from the running of the server. It has often been the case that all auditing is switched off in order to aid performance. This is not recomme
ng and the recommendations here represent the bare minimum that a server should have and should not represent a detriment to the perfo
Audit packages available via a database link3.10.10%Use invoke
lligent agentzusers may use the same login and password for convenience or to hide their identity. This make saccountability impossible.0a

ù•¿ÿ 
±ú„Œ

(ü‘¿ÿ 
Žý÷
„Œ

úþc’ûÓ<

ÒÇl¿ÿ 
&ËÀPëÎj¿ÿ 
ùÕx„œ(䧿ÿ 
kèêð]¿ÿ 
Š÷
å „¨!
|¿ÿ 
E„¨O Œ

¿ÿ 
S-+Ó0ì¿ÿ 
ð3

sure external users have the least privileges possible+D
o not use remote host based authentication3Check that no external users have SYS

Page 186
 391424375

Page 187
 391424375

ðÐTXƒ-à “"„.à/€

Page 188
 391424375

|ý
Ïý
½ý
½ý
½~
@ý
Ý

Ý

Page 189
 391424375

Page 190
 391424375

Page 191
 391424375

Page 192
 391424375

Page 193
 391424375

ÐÐTXƒ-à “"„.Ð/°

Page 194
 391424375

`
ý
ý
ý
~
@ý
Ý

Page 195
 391424375

Ý

Page 196
 391424375

IpaulOracle_D
atabase_Checklist×ÜD
Íhefile:///C:/D
ocuments%20and%20Settings/Paul/D
esktop/aaaaaao/mainrefs/paulOracle

Á
ƒ„¡"d
@$
@õ
p“@

Page 197
 391424375

@$!

!
½

Page 198
 391424375

@$A
â@ý

Á
ƒ„¡"
@$
@õ

Page 199
 391424375

p“@

Page 200
 391424375

@$!

Page 201
 391424375

'~
"ð?ý
"Gý
"÷
ý
"Hý
"žý

Page 202
 391424375

@$A

Page 203
 391424375

@$a

Page 204
 391424375

@$

Page 205
 391424375

@$¡

Page 206
 391424375

@$Á


Page 207
 391424375

Page 208
 391424375

@$á

Page 209
 391424375

@$
@õ
p“@

Page 210
 391424375

@$!

Page 211
 391424375

"'~
"@ý
"ý
"ý
"ý
"ý

Page 212
 391424375

@$A

Page 213
 391424375

@$a

Page 214
 391424375

@$

Page 215
 391424375

@$¡

Page 216
 391424375

Page 217
 391424375

@$Á


Page 218
 391424375

Page 219
 391424375

@$á

Page 220
 391424375

@$
@õ
p“@

Page 221
 391424375

@$!

Page 222
 391424375

"'~
"ð?ý
"Šý
"Šý
"‹ý
"Œ

ý

Page 223
 391424375

"ý
"žý

Page 224
 391424375

@$A

Page 225
 391424375

ðõ-ðõ.ð`
“/ðp“0ð1ð2ðõ3ðõ4ð¤¼5ð¤¼6ð7ð8ð9ð”:ðГˆ;ðГ<ðð“=ðõ>ð”?ðˆ…ý

#7~
#0±@ý
#šý
#°ý

Page 226
 391424375

ð`
“@-ðp“@.ð@/ð@0ð@õ1ð@õ2ð¤¼@3ð¤¼@4ð@5ð@6ð@7ð”@8ðГ@ˆ9ðГ@:ðð“@;ð@õ<ð”@=ð@ˆ…>ðP”@ý

Page 227
 391424375

Gý
¾
ñ

Page 228
 391424375

¾<ý

ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 


ù®


00PXdlt|„
ÿ 
ÿ 
 ÀFMicrosoft Excel Worksheetþÿ 
ÿ 
ÿ 
8FIBExcel.Sheet.8CompObjÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 


Page 229
 391424375

ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 


QRSTUVWXYZ[\]^_`
abcdefghijklmnopqrstuvwxyz{|}~ €Rÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
 ÀFâ.«QÇ"Workbookÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
ÿ 
4SummaryInformation(ÿ 
ÿ 
ÿ 
ÿ 
ðD
ocumentSum

##0\)!
"$"#

ngGuideV3…¯ùVulnerabilitiesPatches…o

ow Level sensitive data.}If the listener.ora is the main point of Listener configuration then it should be secured appropriately using OS permi

led.set:
a in 8i and sqlnet.ora in 9i/10g:

ema account from Oracle Applications. D
efault it has several ANY privs
nd nefarious copies of listener.ora and sqlnet.ora.

sible for removing leaving accounts and checking this has been done in Oracle.The SYS and SYSTEM password are default user accounts
easy to change the port.(Change the port using listener.ora file.(Change the names of the SID
and ListenerPChange the default SID
name f

rson but not much more. Users that do not need complete power should access as SYSOPER for maintenance or as a low privileged Orac
.
much itme.Audit external tables Save archivelog files to diskFLocate archive log files and check no user except ORACLE can read themBPa

R2D
4B13A8416073A1REP_OWNER88D
8F06915B1FE30BD
99EC2D
D
84E3B5CREP_USER57F2A93832685AD
BREPAD
MIN915C93F349

Page 230
 391424375

name

wner of Oracle Portal Single-Sign onPORTAL30_SSO_AD
MINBD
E248D
4CCCD
015D
APORTAL30_SSO is the admin account of Oracle Po

.PSB28EE1E024FC55E66[PSB is a schema account from Oracle Applications. D
efault it has several CREATE privileges.PSP4FE07360D
4
OSSAQ_SUB is an administrative account of Oracle9iAS Syndication Server.OTAF5E498AC7009A217ROTA is a schema account from Ora

Oracle Portal.PORTAL30_AD
MIN7AF870D
89CABF1C7
he database should be in ARCHIVELOG mode which means that the redo logs are kept so that the database can be reinstated to a previou
s a bad reason given the fall in disk prices.92776EA17B8B5555[XNM is a schema account from Oracle Applications. D
efault it has several C
3 June 2004JAlert 66
0645183812087[ECX is a schema account from Oracle Applications. D
efault it has several CREATE privileges.EJB69CB07E2162C6C93EJ

Oracle Security Update Rev 4

ecially when auditing privileged users.

ys.aud$ then can use auditing to protect the audit.

itchfield and Pete Finnigan as well as all the SANS oracle security team led by Paul Wright.¸The other logs apart from Basic Oracle Auditin
Listener.log
mmand.
ed to catch the time that users logon and off. It would generate a lot of audit. The same principle follows for these audit actions:
alter
s.net/ The audit logs are easily readable via a view called dba_audit_trail.
ases state can always be inspected using Logminer https://www.giac.org/certified_professionals/practicals/gcfa/0159.php or reinstated.[IPA
D
S`
a process list can show programs that are not meant to be running. One of these may be maliciousYlsof will list the processes on UNIX a

Page 231
 391424375

ATA_FILE_D
IR';

ed%';[IBP is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IBU0AD
9ABABC74B3057[IBU is a schem
d then on the production machines unless it breaks current applications. The last two CPUs on 10 have applied more smoothly now that the
h there are many such as bugtraq and packetstorm.

m a non windows machine as it relies on the way that the username is formed.÷
TNS sends much information in the clear such as the versio
sign a specific account for applications like Toad so that it can be locked down in a way specifically to that application and its activitied monit
authorised access.*ad-hoc queries against production databasetest and development databasesseparate the two and try to mirror closely

8.015.08.025.09.016.00.006.01.016.01.026.01.036.01.046.01.056.01.066.01.076.02.016.03.016.03.026.03.036.04.016.04.026.04.036.04.0

in writing.ŠThis process is difficult to do automatically and if there is a lot of code it may be worth seeking a specialised Code Review consu
SQL D
eveloper and D
BA studio can be used to remotely access an Oracle database just like SQL*PLUS. These tools can all
sult which is passed back.ÄChecksumming all the objects in the database can be done using the packages within Oracle there is no need t

'ALTER SESSSION');

e binaries used to run oracle then a denial of service could be easily mounted. Also malicous binaries could be written over the actual b inar

Page 232
 391424375

n be used to get a hash value of a package.áOEM is very functional but its automation is built upon default account settings that are insecu
then setting up an IPSEC tunnel would be a more practicable solution. The best solution is the most expensive being Oracle Advanced Sec
ta.
destination and SID
and it can accept wildcards unlike valid node checking.„needs configuring on each client in sqlnet.ora:

ntrolled by the LSNRCTL utility which previous to 10g allowed remote administration of the listener without authentication by default. This m
mum passworded Listener and very preferably should be Admin Restrictions ON which is now the default in 10g.

parameter is set to NONE prior to 8.1.7 and EXCLUSIVE after that. It should be checked that the value has not been changed.Ðdepends o
tools which may be encrypted weakly. Should be deleted. Also the accounts used via developer tools should have least privilege applied to

e to remove these but not always possible so remove all privileges to them.
RD
A output to Support
se..Use metalink to source the patch

g products such as NGS SQuirreL for oracle which has over a 1000 entries. There is a list of common default usernames in the appendices

count PROFILE myprofile;

;áThe redo logs are a record of the SQL commands needed to return the database to a previous state and may be archived preferably rem
ecurity of these accounts by locking the default ones but they still come with default passwords. 8i and 9i have many default accounts that a
privilege

privilege

privilege

granted_role

d objects and objects that have known vulnerabilities."Set up profiles for database usersèAs well as pass management Profiles allow for ses

Page 233
 391424375

used. D
BA accounts should cut out more quickly and have less sessions per user normally.~Set _trace_files_public parameter when set to
min directory of your

actual persistent data and need to be protectedæThe database file location is usually in the parent directory of the control files which can b

der to recognise suspicious activity in the database the dba should monitor all log files which are kept historically for a set period of time.Re

-rs and joinersœif absolutely needed could keep on production server but would need v.good reason such as no other place t

required.
mply involves making a copy of the redo log which can be done by Oracle Multiplexing or OS level mirroring. Put the mirrors on a different d
s both at the OS layer and D
B layer.ÍUse secure delete software to wipe the disks or magnetically wipe them. Then destroy them phsysical
/tmp
grantee from dba_tab_privs where table_name='D
BMS_BACKUP_RESTORE';
Business decision as to what Java permissions are required if Java is being used at all.RIn order to limit the Role inheritance heirarchy set

lock time and gracetime. Use of profiles is heavily recommended.

object_type type

Page 234
 391424375

y.
temporary_tablespace from dba_users; this will provide a list of tablespaces with SYSTEM. Change these with the following S
esses should access the database through one specific account€By enabling batch accounts at the time they run and disabling other accou

n.OWACA5D
67CD
878AFC49
F is a schema account from Oracle Applications. D
efault it has several CREATE privileges.OZPB650B1BB35E86863[OZP is a schema acco
B67D

URBINE76F373437F33F347UD
D
ISYS@UD
D
ISYS is an administrative account of Oracle9iAS Web Services.ULTIMATE4C3F880EFA3640
1893A5FCA23BFWEBCAL01C69573E9D
EC14D
50WEBD
BD
4C4D
CD
D
41B05A5D
WEBREAD
xAURORA$ORB$UNAUTHENTICATED
is a
D
EMO9 is some kind of demonstration account.D
ESABFEC5AC2274E54D
3D
ES is a common name for a Oracle D
esigner ac
Server. It should not exist in a production environment.D
IPCE4A36B8E06CA59CD
ISCOVERER_AD
MIN5C1AED
4D
1AAD
AA4CD
ISCOVER
E38619A12E0257ORAD
BA
ROBE2E3EA470A4CA2D
943User used to execute default password check scriptsORAREGSYS28D
778112C63CB15ORASSOF3701A008
Master_Peer Agent

23 July 2003LAlert 55
s and passwords to make scripts work easilyÀit is possible to read a users environment remotely so these should be audited and any that a

ing. OCITESTC09011CB0205B347OCM_D
B_AD
MINROCM_D
B_AD
MIN is an administrative account of Oracle9iAS Certificate Manager (O

ces to Oracle Internet D
irectory.OE9C30855E7E0CB02D
62FAD
F01C4D
C1ED
4D
1A2D
FC623FD
A40AQOE is a schema account from Orac
al CREATE privileges.MFGFC1B0D
D
35E790847RMFG is a schema account from Oracle Applications. D
efault it has several ANY privs9D
1
URMOT_D
E_PASSEFD
621020564A4978
terConnect (OAI).
software targeted at chemists and analysts.MANPROD
F0EB74546E22E94D
MARKPASSWO3F7101600ACABCD
74]MARK i
) has D
BA-like privilegesMEE5436F7169B29E4D
§There may be teething stage for a new application that requires temporary privileges to t
segment_type

ed by privileged users.Resources used by the database¤Resources can become overused especially with installation of third party applicat

e limited below these users.8Restrict shell history files for usernames and passwordsƒshell history recalls the previous commands but coul

Page 235
 391424375

RUE

s rotation. It is worth correlating with SYSOG and ID
S logs using timestamp as the central unifier of these logs. Therefore strong synchronis

nitised before sending to Oracle support.RA perl script could be used to parse the RD
A files before sending to Oracle Support. This is a curr
g veritas volume manager or similar then will have to use the tools supplied with that software.$Usernames/ passwords in process list'Oracle
kstream Collector Agent Java Object Cache port D
CM Java Object Cache port #Oracle HTTP Server D
iagnostic Port "Oracle HTTP Server

Edit cman.ora and restart Connection Managersnmp_rw.orachange dbms_xdb.cfg_update8Edit listener.ora/init.ora and restar
Net Listener Oracle D
atabase
acle Enterprise Manager 'Oracle Connection Manager Admin (CMAN) Enterprise ManagerAge< nt port Enterprise Manager RMI port Oracle
G_REPORTSE9473A88A4D
D
31F2From a bookCALVINHOBBES34200F94830271A3_CALVIN is an account to demonstrate AOLServer. It

ministration account for Oracle Applications. It controls the Concurrent Manager.APPSE153FFF4D
AE6C9F70F886772980B8C79

PACE.A5E09E84EC486FC9D
728438E8A5925E0—APPS is an often used name for management or schema accounts for applications. In
word hashes which in combination with the username makes decrypting the hash feasible.MAudit access to critical sys/dba owned tables an

4[GMS is a schema account from Oracle Applications. D
efault it has several CREATE privileges.GPFD
BA787E988F8BC4242GPFD
is an ac

RSTUVWXYZ[\]^_`
abcdefghijklmnopqrstuvwxyz{|}~ € has amongst others!
CREATE D
ATABASE LINK privileges.AD
AMSWOOD
72CD
EF4

F5E401A4AK8FCB78BBA8A59515SAK is a schema account from Oracle Applications. D
efault it has many ANY privilegesALHROXXX049
cle Applications. D
efault it has several CREATE privileges.IBA0BD
475D
5BF449C631.09.041.09.052.00.002.01.012.01.022.01.032.01.042.
IF the Intelligent agent functionality is to be kept.This package can be used to used to escalate privilege and so should not have privileges

hould be enforced strongly. The D
BA role and SYS user will have this privilege.1.01.011.00.001.01.021.01.031.01.041.01.051.01.061.10.01

ese privileges.%REVOKE EXECUTE ON UTL_TCP FROM PUBLIC&REVOKE EXECUTE ON UTL_HTTP FROM PUBLIC&REVOKE EXEC

Page 236
 391424375

bles are a link to the OS which allow database user to modify OS file and OS user to modify database file if the permissions allow. Therefor

D
o not allow backups to be available on-line)Create and use media retrieval proceduresHSeparate the Oracle software from d
es; and

ure reports and alerts are in place to deal with irregularities found through auditCBe aware of possible failure to be alerted of suspicious ac
acle client file permissions(Audit client configuration file contents8D
iscover what objects can be seen in the linked database< (Create a po

xtended init.ora file which may not show when a text editor is used.9Check IFILE and the contents of files pointed to by IFILEIFILE paramet

.Check for SQL92_security TSELECT * FROM v$parameter where name ='serializable'; Not In 10g r2

CT ANY TABLE ™This SQL will list all parameters:

'^') like '^%';

mple _system_trib_enabled set to FALSE will switch off all SYSTEM triggers which may be used for auditing actions on objects. This shoul
may cause an denial of service on the application . Autoextensible tablespaces can also grow and deman too much disk space so this shou

a schema owned by someone else.¾This query will find triggers not owned by the schema owner.
table_owner

port for that connection. This will be blocked by most firewalls so one solution is to force MTS to allocate a known port after the initial excha

Page 237
 391424375

t databases that can be accessed'D
isable iSQL*Plus on production serversindexName of precautionary measurecriticalityplatformversionTh

privilege from dba_tab_privs where grantee in((select grantee from dba_tab_privs)minus

al data1Audit generated applications for known weaknesses4Audit public libraries used for know vulnerabilitiesUse change controlAudit use

other user. This should be avoided and monitored.¿select grantee

'PUBLIC')
usines processs required to match the allocation of system privileges to the business requirement.Íif context is not being used then drop CT

ter where name ='os_authent_prefix';

segment_type

werful role and should not be widely used so check for users and roles that have it.tCompromise to taking away D
BA role is to strip down th

Page 238
 391424375

ich it is by default. This is inherently insecure and additionally NGS has found buffer overflows in the fixes that were made to subsequently s

'D
ELETE_CATALOG_ROLE');
table_name

archivelog mode?Å
This query is for general parameter values.

rver and represent an additional attack surface which if not needed should be removed.\PUBLIC has privileges on STATS$% tables and sho

Page 239
 391424375

privilege

privilege

constraint n_pk primary

'abc');

Page 240
 391424375

'eee');
horised privileged access.‰Note that SYS AS SYSD
BA cannot be locked in this way so strenght in depth with the other measures needed

select the users and roles that can select the hashes.

'OLAP_USER'

em rather than this method which looks at everything an individual can see and have to be repeated for each individual.$Audit views to ensu
ll auditing is switched off in order to aid performance. This is not recommended. Auditing of most important actions should be made as a m
hat a server should have and should not represent a detriment to the performance of the server. Addtionally auditing can be added from her
Add password management for default accountsAudit internal alias login>= 8i#Audit non database Oracle passwords;Create b
nvenience or to hide their identity. This make saccountability impossible.0alter profile default limit sessions_per_user 1;ALL&Host Operating

üeQïX¿ÿ 
N·„Œ

0u¿ÿ 
Ç„Œ

ù>¿ÿ 
[Ò

E„¨O Œ

¿ÿ 
S-+Ó0ì¿ÿ 
ð3 „¾¥7¾ Ï:脨I<b¿ÿ 
@$¿ÿ 
 HPBð¿ÿ 
ž°μ¿ÿ 
 KPC˜¿ÿ 
 MLpP¿ÿ 
 L+Å
Ü¿ÿ 
 NÏ\¿ÿ 
 I¿ÿ 
 J¿ÿ 
ÀÐD
" ‚„¨RØKÿ 
ôôôÿ 
ôôôC0€ A

remote host based authentication3Check that no external users have SYSD
BA or SYSOPER+Revoke public execute privilege on utl_file*R

à?à?U

Page 241
 391424375

cuments%20and%20Settings/Paul/D
esktop/aaaaaao/mainrefs/paulOracle_D
atabase_Checklist.htmï72paulOracle_D
atabase_Checklistsk#

’@$€
@õ
@ˆ

Page 242
 391424375

’@$€"

!
ݬ!
Àâ@ý

Page 243
 391424375

’@$€B

à?à?U
’@$€
@õ

Page 244
 391424375

@

Page 245
 391424375

’@$€"

Page 246
 391424375

’@$€B

Page 247
 391424375

’@$€b

Page 248
 391424375

’@$€‚

Page 249
 391424375

’@$€¢

Page 250
 391424375

’@$€Â

Page 251
 391424375

’@$€â

Page 252
 391424375

’@$€
@õ
@

Page 253
 391424375

’@$€"

Page 254
 391424375

’@$€B

Page 255
 391424375

’@$€b

Page 256
 391424375

’@$€‚

Page 257
 391424375

’@$€¢

Page 258
 391424375

’@$€Â

Page 259
 391424375

’@$€â

Page 260
 391424375

’@$€
@õ
@

Page 261
 391424375

’@$€"

Page 262
 391424375

’@$€B

Page 263
 391424375

Page 264
 391424375

##0_);[Red]\("$"#

o it is worth explicity checking these accounts due to their sensitivity.Additional to running a password cracker or default password check it i
place less load on the D
NS system but larger networks require hostnames so that traffic can travel between subnets and so that an IP relat

maps to SYS AS SYSD
BA which is the most powerful user/role combination in the Oracle database. OSD
BA can shutdown the whole datab

ows a windows service to be shut down remotely. Therefore secure the ORACLE account3Where Windows is being used migrate towards 2

ions. D
efault it has several CREATE privileges.RHXFFD
F6A0C8C96E676[RHX is a schema account from Oracle Applications. D
efault it ha

Page 265
 391424375

kind

rtal Single-Sign onPOS6F6675F272217CF7

A privilegesPUBSUB1D
6D
F5BBC8B64933EPV76224BCC80895D
3D
ZPV is a schema account from Oracle Applications. D
efault it has sev
A362F8314299WOBD
27FA6297C0313F4WPS50D
22B9D
18547CF7[WPS is a schema account from Oracle Applications. D
efault it has sev

E[XNS is a schema account from Oracle Applications. D
efault it has several CREATE privileges.XPRT0D
5C9EFC2D
FE52BAXTRA43EE962
Security Vulnerabilities in Oracle Application Server Web Cache Rev 2
duction environments.ENG5.11.015.11.025.12.01Õdba_fga_audit_trail is the main view for seeing this row level audit and should be used.

2 March 2005ÉSome audit has to be done and therefore some review of audit logs has to be done.

access_log

create user

D
efault it has several CREATE privileges.IPLANET7404A12072F4E5E8OIPLANET is an account belonging to iPlanet (now called Java En
ot meant to be logged in most times can be checked to see if they have a session openSELECT * FROM v$session;1 Third party application

Page 266
 391424375

ash that has been sniffed instead. This is assuming that the Listener password has been encrypted.

Application server error pages etc should all be minimised as this is valuable recon< aisance for a hacker. Especially using h

is safer and easier to manager in terms of disk space. Access to these logs should be strictly controlled as they can allow the database to b
efault accounts for third party applications that use Oracle. This list of default accounts includes users and roles.PUBLIC role has privilege

Page 267
 391424375

BE8142502E10SERVICECONSUMER1183AC2094A6BD
59FSH9793B3777CD
3BD
1A54B253CBBAAA8C481729F80C5FA78841

onnect to the database. Revoke the connect role and replace with a stripped down version that has CREATE SESSION

a real recovery can be done efficiently in case of crisis.

ct log_mode from v$database;

many security researchers in the past though the potential for attack via backups is now becoming more well known.
/" or other locations where important scripts lie. The reason being that UTL_FILE could be used to open a script and then save

owner owner

Page 268
 391424375

ofile view can be used to control users access. This is not available for OD
BCÆThe PUP can be bypassed so it should not be relied on hea

C27FA786BA774CORACLE9I86FD
B286770CD
4B90RACLE9IB171042374D
7E6A20RACL39ID
7C18B3B3F2A4D
4BTAHITIF339612C73D

SER1BBE7786A584F9103USER21718E5D
BB8F89784USER394152F9F5B35B103USER42907B1BFA9D
A5091USER56E97FCEA92BAA
s. D
efault it has several ANY privsAZAAA18B5D
51B0D
5ACZAZ is a schema account from Oracle Applications. D
efault it has several CREA
D
ES2K is an account of Oracle D
esigner 2000.
of Computer and Information Services from the University of Missouri-Rolla.D
SGATEWAY6D
SGATEWAY is an account for Oracle Syndicatio

ign-On.ORASSO_PA133F8D
161296CB8F?ORASSO_PA is an account belonging to Oracle9iAS Single Sign-On.ORASSO_PS63BB53425

for Oracle9i D
atabase ?Alert 29

Unauthoriz< ed D
isclosure of Information in Oracle E-Business Suite ²jdbc thin drive transmits clear text error message inclu
ompt the user to input their password manually as compromise.®


#!
/bin/bash/

irectory metadata.
Repository.OEMAD
M9D
CE98CCF541AAE6OEMREP7BB2F629772BF2E5OKBA01A5F0698FC9E31OKC31C1D
D
F4D
5D
63FE6[OKC is a
5C8562876B0382D
5B550MOD
TESTYESBBFF58334CD
EF86D
MOREAUCF5A081E7585936BMRPB45D
4D
F02D
4E0C85RMRP is a sche

MD
D
ATAD
F02A496267D
EE6610gMD
D
EMO46D
FFB4D
08C33739MD
D
EMO_CLERKCLERK564F871D
61369A39@MD
D
EMO_CLERK is a

this to the maximum resources available on that server and increase if necessary using ALTER SYSTEM.}Care should be taken when imple

mount as is appropriate for your environment for each user.âPutty is a free and popular client that can be used for client connections. http://

Page 269
 391424375

BA may wish not correlate logs. The first time this is done takes along time but once a process is in place it can be automated. Time synchro

ority (OCA) - Mutual Authentication +Oracle9iAS Web Cache HTTP Listen(SSL) port Oracle TimesTen &Oracle Enterprise Manager Web Co
e XMLD
B HTTP port OC4J Forms / Reports Instance Oracle D
eveloper Suite Oracle Forms Server 6 / 6i Oracle SOAP Server OS Agent Or

the contents are correct and no nefarious copies of these files can be viewed by an unprivileged user.

C4J IIOPS1 Oracle OC4J IIOPS2 Oracle OC4J JMS Oracle9iAS Web Cache Admin port
ema account from Oracle Applications. D
efault it has several CREATE privileges.CD
EMO827299A5E2A5A05820SThis is a training accoun

It has D
BA-like privileges.APPUSERAPPPASSWORD
7E2C3C2D
4BF4071B5ALL_USERS is a view like D
BA_USERS but intended for an

CREATE privileges.HAD
ES2485287AC1D
B6756HCPARK3D
E1EBA32154C56BHLW855296220C095810WHLW seems to be part of a 9iA

NJETSPEED
CAC22318F162D
5976AD
MIN is an administration account of Apache Jetspeed.B8B15AC9A946886AUAD
MIN is a generally

MS is a schema account from Oracle Applications. D
efault it has several CREATE privileges.AMV38BC87EB334A1AC4[AMV is a schema
ckstream Intelligence.CLKRT8CLKRT is an account for Oracle Clickstream Intelligence.CN73F284637A54777D
QCN is a schema account
e appserver to work again.6alter user system account lock; or can also set the password to an impossible password using an impossible pa

21.04.031.04.041.04.051.04.061.04.071.04.081.04.091.05.011.05.021.05.031.06.011.06.021.06.031.06.041.06.051.07.011.07.021.08.011.

Page 270
 391424375

o native PL/SQL compilation in production¯v$parameters should be set to false or null.

saster recovery procedures4Include business users in disaster recovery planningApplication D
evelopment+Checksum all PL/SQL objects in

dmin directory3Add only minimum configuration files to all clients>Keep up to date with Oracle listener vulnerabilities and patch&Secure rem

used or not. If so check the second parameter file to see what parameters are being set.hsearch the init.ora for an IFILE parameter and fol

pace quota¾In order to stop a user from taking up too much tablespace and possibly causing a D
oD
accidentally or maliciously a quota sho

table_name from dba_triggers where owner<>table_owner and owner not in ('SYS'

Page 271
 391424375

may be hardcoded with this datasudo to oracleBlack of identity trail i.e. who is it that is logging on as oracleLock Oracle account2D
o not nam

s a non privileged userçCREATE ANY D
IRECTORY privilege allows a user to make a bridge between the D
B and OS which is a potential se

Page 272
 391424375

e setting of 07_D
ICTIONARY_ACCESSIBILITY =FALSE would mean that they could not SELECT from the data dictionary which holds imp

'SELECT_CATALOG_ROLE'))

that there has been a bug in Oracle where Set _trace_files_public to falseEnsure system triggers fire>=8iCEstablish different users for sch

y Auditing by Arup Nanda for more detail on Auditing on Oracle.)Monitor Other Oracle generated log files
Check that remote_os_authent is set to false4CB05AA42D
8E3A47SWUSER783E58C29D
2FC7E1SYMPAE7683741B91AF22
ORACLE_HOME and ORACLE_BASECheck trace file permissions"Check permissions of the datafiles#Check for sensitive temporary filesC

¥êQ½!
p‹(ÐO`
)¥lÃ*a

sys owned packages.3Revoke the public execute privilege on dbms_ranccŠ

Page 273
 391424375

à?à?U
’@ÿ 
Ï
`
“@
@

Page 274
 391424375

’@ÿ 
Ï#

Page 275
 391424375

’@ÿ 
ÏC

’@ÿ 
Ï
`
“@

Page 276
 391424375

Page 277
 391424375

’@ÿ 
Ï#

Page 278
 391424375

’@ÿ 
ÏC

Page 279
 391424375

’@ÿ 
Ïc

Page 280
 391424375

’@ÿ 
σ

Page 281
 391424375

’@ÿ 
Ï£

Page 282
 391424375

’@ÿ 
ÏÃ

Page 283
 391424375

’@ÿ 
Ïã

Page 284
 391424375

’@ÿ 
Ï
`
“@
@

Page 285
 391424375

’@ÿ 
Ï#

Page 286
 391424375

’@ÿ 
ÏC

Page 287
 391424375

’@ÿ 
Ïc

Page 288
 391424375

’@ÿ 
σ

Page 289
 391424375

’@ÿ 
Ï£

Page 290
 391424375

’@ÿ 
ÏÃ

Page 291
 391424375

’@ÿ 
Ïã

Page 292
 391424375

’@ÿ 
Ï
`
“@
@

Page 293
 391424375

’@ÿ 
Ï#

Page 294
 391424375

’@ÿ 
ÏC

Page 295
 391424375

##0\)""$"#

ers accounts for weak passwords"vSet the fixed MTS dispatchers in the init.ora file.

as it known and would make attacking the OS easier.-controlpanel>admintools>compmanagement>groupsGmanually create a group that

d need write access to the files in the bin so there should not be discussion on this point. It is possible to run with tighter permissions thoug

557D
[RLM is a schema account from Oracle Applications. D
efault it has several CREATE privileges.RMAILD
A4435BBF8CAE54CRMANE7

Page 296
 391424375

action

QP10A40A72991D
CA15ZQP is a schema account from Oracle Applications. D
efault it has several CREATE privileges.QS8B09C6075BD
F
C13[WSM is a schema account from Oracle Applications. D
efault it has several CREATE privileges.WWW6D
E993A60BC8D
BBFWWWUSER

8IFAAD
7AD
AF48B5F450RACLE8685657E9D
C29E1850RACLE949B70B505D
F0247F0RACLE8IB49C4279EBD
8D
1A80RACL38604101D

2 April 2004NAlert 65

error_log

create role

chema account from Oracle Applications. D
efault it has several CREATE privileges.JA9AC2B58153C23F3D
ssave Oracle logs to syslog in
o strong anyway. It is often possible to bypass application security by logging in directly as the application user.Coracle label security can be

Page 297
 391424375

mmends the use of data encryption within the database which hinders an attacker and also stops D
BA's from reading very sensitive data. T

AB4E5FD
2217F7AAUTLBSTATUUTLESTATC42D
1FA3231AB025VEAD
38D
161C22345902[VEA is a schema account from Oracle Applicat

racle Applications. D
efault it has several CREATE privileges.BICE84CC95CBBAC1B67[BIC is a schema account from Oracle Applications.

Applications. D
efault it has several CREATE privileges.ASOF712D
80109E3C9D
8[ASO is a schema account from Oracle Applications. D
ef

Vulnerability in PL/SQL EXTPROC in Oracle9i D
atabase UAlert 28

and SGID
files in $ORACLE_HOME¼older versions of oracle 8 have many SETUID
and SGID
binaries most of which can be removed eithe

t it has several CREATE privileges.OKI991C817E5FD
0F35AOKO6E204632EC7CA65D
OKRBB0E28666845FCD
C[OKR is a schema accou

CREATE privileges.MSD
6A29482069E23675[MSD
is a schema account from Oracle Applications. D
efault it has several CREATE privileges

and secure it at the Oracle end. This also means that auditing and logging can be individual to the account being used rather than having al

Page 298
 391424375

e about schema structure is available from the code in Oracle6Pre-compile Java code before loading into the databaseWEBSYSA97282CE

protect client transmissionsF8841A7B16302D
E6*Can be spoofed remotely so need to disableOSELECT value FROM v$parameter where n

s null.LSELECT value FROM v$parameter where name ='remote_listener';

'SYSTEM');#Remove PUBLIC select on ALL_USERS database linksD
atabase links are useful to make connections from one

Page 299
 391424375

using it maliciously#time to lock and unlock when neededpasswd -l <username>7Use separate owner for listener from database softwareB

privilege='CREATE ANY D
IRECTORY';CREATE ANY JOB privilegeoCREATE ANY JOB privilege allows the grantee to run PLSQL jobs as

Page 300
 391424375

B user to delete and will less likely affect the running of the D
B if the Audit logs get very large. SYS.AUD
$ is the database table that takes th

E819B32A03D
2905ECA56A83022664074AF827F4B74A41B328CA13F707130B4409D
D
D
56889136CFF5709390412783522F32D
D
32A97
e password transmission on the client)Permissions on Oracle SUID
and SGID
files@Audit the machine for scripts containing usernames and

aaµ2ÖC6>k¦8Çt <A¿ÿ 
å=„¢Ì@í6›B¼Q5EV¿ÿ 
wG˜¿ÿ 
;I\¿ÿ 
Q„¨^¿ÿ 
èbåVÙfÖógðLÏhÌ

Page 301
 391424375

0Ò@|

@õ

Page 302
 391424375

0Ò@|$

Page 303
 391424375

0Ò@|D

0Ò@|

Page 304
 391424375

@õ

Page 305
 391424375

0Ò@|$

Page 306
 391424375

0Ò@|D

Page 307
 391424375

0Ò@|d

Page 308
 391424375

0Ò@|„

Page 309
 391424375

0Ò@|¤

Page 310
 391424375

0Ò@|Ä

Page 311
 391424375

0Ò@|ä

Page 312
 391424375

0Ò@|

@õ

Page 313
 391424375

0Ò@|$

Page 314
 391424375

0Ò@|D

Page 315
 391424375

0Ò@|d

Page 316
 391424375

0Ò@|„

Page 317
 391424375

0Ò@|¤

Page 318
 391424375

0Ò@|Ä

Page 319
 391424375

0Ò@|ä

Page 320
 391424375

0Ò@|

@õ

Page 321
 391424375

0Ò@|$

Page 322
 391424375

0Ò@|D

Page 323
 391424375

##0.00_);\("$"#

se the name ORA_D
BA for the OSD
BA group on Microsoft.:Check who is creating trace files and audit their presence!
trace files can contai

027 but depends on how many people are in the OSD
BA group and how structured. If only two in OSD
D
BA/SYSD
BA group then maybe 02

he database to the backups.RRS5CA8F5380C959CA9SAMPLEE74B15A3F7A19CA81SAMPLE is possibly an account with D
BA privileges

Page 324
 391424375

CFACF5AE24964870C36D
8E6CD
7CF5A2A1265A6BD
C8F36QS_CBAD
M7C632AFB71F8D
30520E788F9D
4F1D
92C58C823BA7A2D
3D
7
m Oracle Applications. D
efault it has several CREATE privileges.XLA2A8ED
59E27D
86D
41[XLA is a schema account from Oracle Applicatio

atabase management account. It allows to read12CFB5AE1D
087BA3380E3D
3AD
5CE32D
42563EFAAE44E785AE7686462E8CD
2F5E691

Security Vulnerability in Oracle9i Application and D
atabase Servers Rev 4

sqlnet.log. These can be used to correlate information after an incident.Å
The location of these logs should be known before a

What encrytion is used by the application. Is the database security stronger the application password security.ISQuirreL allows password au

Page 325
 391424375

ult functionality. discussion should not be needed.HOracle passwords are by default limited to 30 characters that can be used and the varie

s several CREATE privileges.VERTEX_LOGIND
EF637F1D
23C0C59VID
EOUSER29ECA1F239B0F7D
F

al CREATE privileges.BIM6026F9A8A54B9468[BIM is a schema account from Oracle Applications. D
efault it has several CREATE privilege

ions. D
efault it has several CREATE privileges.ATMSAMPLEATM7B83A0860CF3CB719iR2 default accountAUD
IOUSERCB4F2CEC5A352

Vulnerabilities in Oracle mod_plsql and JSP in Oracle9i Application Server BAlert 27

Applications. D
efault it has several CREATE privileges.OKXF9FD
EB0D
E52F5D
6B[OKX is a schema account from Oracle Applications. D
efa
0FE77D
813[MSR is a schema account from Oracle Applications. D
efault it has several CREATE privileges.MTS_USERMTS_PASSWORD
E

hird party application.ZJA is a schema account from Oracle Applications. D
efault it has several CREATE privileges.JAKEPASSWO41CE0B

Page 326
 391424375

64F9ZWH is a schema account from Oracle Applications. D
efault it has several CREATE privileges.WIPD
326D
25AE0A0355C[WIP is a sche

PRIVATE or GLOBAL. PUBLIC can be used by any user and if this link is made using a fixed user the authentication details w

Page 327
 391424375

YSTEM tablespace is not supported by Oracle but can be done.

orkflow Manager.D
C86E8D
EAA619C1A639C32A115D
2CA57ÖRun a port scan using NMAP and vulnerability scan using Nessus or NGS S
HSave log files to a separate server using Syslog or Windows event viewer(Integrity check O/S files used by Oracle#Review expected proc

ªk§„¨ÿ 
mØ6 pù„¨xrQ¿ÿ 
¨t ©v‚ ÎWy0¿ÿ 
„~]¿ÿ 
í€Æ¿ÿ 
'ƒ¿ÿ 
ƒ…\

Page 328
 391424375

@õ

Page 329
 391424375

@%

Page 330
 391424375

@E

Page 331
 391424375

@õ

Page 332
 391424375

@%

Page 333
 391424375

@E

Page 334
 391424375

@e

Page 335
 391424375

@…

Page 336
 391424375

@¥

Page 337
 391424375

@Å

Page 338
 391424375

@å

Page 339
 391424375

@õ

Page 340
 391424375

@%

Page 341
 391424375

@E

Page 342
 391424375

@e

Page 343
 391424375

@…

Page 344
 391424375

@¥

Page 345
 391424375

@Å

Page 346
 391424375

@å

Page 347
 391424375

@õ

Page 348
 391424375

@%

Page 349
 391424375

@E

Page 350
 391424375

##0.00\)'""$"#

e!
trace files can contain sensitive data such as the ability to read internal database structures and be dumped by anyone with ALTER SESS

group then maybe 027 might be more time efficient but our recommendation is 022.# Windows file permissions and type.set file type to NT

unt with D
BA privilegesSAPSAPR3BEAA1036A464F9F0B1344D
C1B5F3D
90358872B4319A76363<SAPR3 is the administration account (a

Page 351
 391424375

C58C823BA7A2D
3D
7FQS_CS91A00922D
8C0F1462CA6D
0FC25128CF35D
85C7E8FB28375FQS_ESE6A6FA4BB042E3C29A5F2D
9F5D

from Oracle Applications. D
efault it has several CREATE privileges.XNCBD
8EA41168F6C664[XNC is a schema account from Oracle Appli

686462E8CD
2F5E691C5E7E424B821A
2 June 2004?Alert 64

uld be known before and incident occurs and practise should be made at correlating these logs so that problems that may occur during an

eL allows password auditing without actually viewing the passwords.(prevents users from sharing account ID
s[IEB is a schema accoun< t f

Page 352
 391424375

be used and the variety of each character is limited to alphanumerics a few special characters all upper case.

veral CREATE privileges.BIS7E9901882E5F3565[BIS is a schema account from Oracle Applications. D
efault it has several CREATE privileg

SERCB4F2CEC5A352488?AUD
IOUSER is the account to manage the Intermedia Audio option.AURORA$JIS$UTILITY$INVALID
_ENCRY

Vulnerabilities in Oracle9i Application Server Webcache @Alert 26

acle Applications. D
efault it has several CREATE privileges.OLAPD
BA1AF71599ED
ACFB00BOLAPD
BA is an administrative account for th
ERMTS_PASSWORD
E462D
B4671A51CD
4MTSSYS6465913FF5FF1831>MTSSYS is an account for Microsoft Transaction Server support

AKEPASSWO41CE0B71B4A34904B]JAKE is an account to demonstrate AOLServer. It should not exist in a production environment.JEFBB

Page 353
 391424375

sing Nessus or NGS SQuirreL for Oracle.

Review expected processes regularlyÿ 
ú¨¿ÿ 
§+²

ˆÃ‹œ™Z¿ÿ 
6ŽôÐî¬
Êˆ¦‘d¿ÿ 
‚’@Ž•L7˜õ

Page 354
 391424375

@Ã

¤¼@

Page 355
 391424375

@Ã&

Page 356
 391424375

@ÃF

@Ã

Page 357
 391424375

¤¼@

Page 358
 391424375

@Ã&

Page 359
 391424375

@ÃF

Page 360
 391424375

@Ãf

Page 361
 391424375

@Æ

Page 362
 391424375

@æ

Page 363
 391424375

@ÃÆ

Page 364
 391424375

@Ãæ

Page 365
 391424375

@Ã

¤¼@

Page 366
 391424375

@Ã&

Page 367
 391424375

@ÃF

Page 368
 391424375

@Ãf

Page 369
 391424375

@Æ

Page 370
 391424375

@æ

Page 371
 391424375

@ÃÆ

Page 372
 391424375

@Ãæ

Page 373
 391424375

@Ã

¤¼@

Page 374
 391424375

@Ã&

Page 375
 391424375

@ÃF

Page 376
 391424375

##0.00_);[Red]\("$"#

nal database structures and be dumped by anyone with ALTER SESSION privilege. Audit the presence of check files to make sure no unau

endation is 022.# Windows file permissions and type.set file type to NTFS

5F3D
90358872B4319A76363<SAPR3 is the administration account (and schema?) of SAP R/3SCOTTTIGERF894844C34402B67TIGGER

Page 377
 391424375

8CF35D
85C7E8FB28375FQS_ESE6A6FA4BB042E3C29A5F2D
9F5D
1A9EF4723007181C44715CQS_OSFF09F3EB14AE5C26ROSM is
NCBD
8EA41168F6C664[XNC is a schema account from Oracle Applications. D
efault it has several CREATE privileges.XNIF55561567EF7

Security Vulnerabilities in Oracle9i D
atabase Server Rev 2

e at correlating these logs so that problems that may occur during an incident are solved beforehand.#Audit failures on critical objectsÖTh

prevents users from sharing account ID
s[IEB is a schema accoun< t from Oracle Applications. D
efault it has several CREATE privileges.IE

Page 378
 391424375

s a few special characters all upper case.

count from Oracle Applications. D
efault it has several CREATE privileges.BIV2564B34BE50C2524BIX3D
D
36935EAED
E2E3[BIX is a schem

he Intermedia Audio option.AURORA$JIS$UTILITY$INVALID
_ENCRYPTED
_PASSWORD
qAURORA$JIS$UTILITY$ is an internal account

D
enial of Service against Oracle9i Application Server 'Alert 25

A1AF71599ED
ACFB00BOLAPD
BA is an administrative account for the OLAP Services option.OLAPSVRINSTANCEAF52CFD
036E8F425B

831>MTSSYS is an account for Microsoft Transaction Server support.MWA1E2F06BE2A1D
41A6[MWA is a schema account from Oracle A

rate AOLServer. It should not exist in a production environment.JEFBB3209FD
6280E69ZJE is a schema account from Oracle Applications.

Page 379
 391424375

“@

¤¼@

Page 380
 391424375

“@'

Page 381
 391424375

“@G

“@

Page 382
 391424375

¤¼@

Page 383
 391424375

“@'

Page 384
 391424375

“@G

Page 385
 391424375

“@g

Page 386
 391424375

“@‡

Page 387
 391424375

“@§

Page 388
 391424375

“@Ç

Page 389
 391424375

“@ç

Page 390
 391424375

“@

¤¼@

Page 391
 391424375

“@'

Page 392
 391424375

“@G

Page 393
 391424375

“@g

Page 394
 391424375

“@‡

Page 395
 391424375

“@§

Page 396
 391424375

“@Ç

Page 397
 391424375

“@ç

Page 398
 391424375

“@

¤¼@

Page 399
 391424375

“@'

Page 400
 391424375

“@G

Page 401
 391424375

##0.00\)7*2_("$"* #

SESSION privilege. Audit the presence of check files to make sure no unauthorised user is doing so and that no unauthorised user can read

o NTFS

unt (and schema?) of SAP R/3SCOTTTIGERF894844C34402B67TIGGER7AA1A84E31ED
7771

Page 402
 391424375

9F5D
1A9EF4723007181C44715CQS_OSFF09F3EB14AE5C26ROSM is a schema account from Oracle Applications. D
efault it has severa

Applications. D
efault it has several CREATE privileges.XNIF55561567EF71890XNM[POM is a schema account from Oracle Applications. D

20 May 20044Alert 63

g an incident are solved beforehand.#Audit failures on critical objectsÖThe failure of any user to update a critical table is classic auditing p

n< t from Oracle Applications. D
efault it has several CREATE privileges.IECCA39F929AF0A2D
ECIEM37EF7B2D
D
17279B5[IEM is a schem

Page 403
 391424375

rivileges.BIV2564B34BE50C2524BIX3D
D
36935EAED
E2E3[BIX is a schema account from Oracle Applications. D
efault it has several CREA

CRYPTED
_PASSWORD
qAURORA$JIS$UTILITY$ is an internal account of Jserver. In 8i changing the password will prevent ORB from wo

Vulnerabilities in mod_plsql Alert 24 was never released - 8Alert 23

or the OLAP Services option.OLAPSVRINSTANCEAF52CFD
036E8F425BOLAPSVR is an administrative account for the OLAP Services o
pport.MWA1E2F06BE2A1D
41A6[MWA is a schema account from Oracle Applications. D
efault it has several CREATE privileges.MXAGENT

EFBB3209FD
6280E69ZJE is a schema account from Oracle Applications. D
efault it has several CREATE privileges.JGÝ In UNIX the usern

Page 404
 391424375

“@

@ˆ

Page 405
 391424375

“@(

Page 406
 391424375

“@H

“@

Page 407
 391424375

@

Page 408
 391424375

“@(

Page 409
 391424375

“@H

Page 410
 391424375

“@h

Page 411
 391424375

“@ˆ

Page 412
 391424375

“@¨

Page 413
 391424375

“@È

Page 414
 391424375

“@è

Page 415
 391424375

“@

@

Page 416
 391424375

“@(

Page 417
 391424375

“@H

Page 418
 391424375

“@h

Page 419
 391424375

“@ˆ

Page 420
 391424375

“@¨

Page 421
 391424375

“@È

Page 422
 391424375

“@è

Page 423
 391424375

“@

@

Page 424
 391424375

“@(

Page 425
 391424375

“@H

Page 426
 391424375

##0_);_("$"* \(#

unauthorised user is doing so and that no unauthorised user can read trace files created.*delete tkprof binary from $ORACLE_HOME/binOt

GER7AA1A84E31ED
7771

Page 427
 391424375

M is a schema account from Oracle Applications. D
efault it has several ANY privsOSP22C04057049D
F974C2
EF71890XNM[POM is a schema account from Oracle Applications. D
efault it has several CREATE privileges.PORTAL

Security Vulnerabilities in Oracle9i Lite < Rev 1

ÖThe failure of any user to update a critical table is classic auditing priority and can be done easilly. The more users who are likely to be aff

s.IECCA39F929AF0A2D
ECIEM37EF7B2D
D
17279B5[IEM is a schema account from Oracle Applications. D
efault it has several CREATE p

Page 428
 391424375

chema account from Oracle Applications. D
efault it has several CREATE privileges.BLAKEPAPER9435F2E60569158EBLEWISC9B597D
7

ount of Jserver. In 8i changing the password will prevent ORB from working.INVALID
E1BAE6D
95AA95F1EAURORA$ORB$UNAUTHENTIC

Oracle D
atabase Server D
BSNMP Vulnerabilities AAlert 22

425BOLAPSVR is an administrative account for the OLAP Services option.´Oracle Context allows a database user to access external files.
cle Applications. D
efault it has several CREATE privileges.MXAGENTC5F0512A64EB0E7FNAMES9B95D
28A979CC5C4

ons. D
efault it has several CREATE privileges.JGÝ In UNIX the usernames and passwords that scripts are being run under may show when

Page 429
 391424375

Page 430
 391424375

@)

Page 431
 391424375

@I

Page 432
 391424375

Page 433
 391424375

@)

Page 434
 391424375

@I

Page 435
 391424375

@i

Page 436
 391424375

@‰

Page 437
 391424375

@©

Page 438
 391424375

@É

Page 439
 391424375

@é

Page 440
 391424375

Page 441
 391424375

@)

Page 442
 391424375

@I

Page 443
 391424375

@i

Page 444
 391424375

@‰

Page 445
 391424375

@©

Page 446
 391424375

@É

Page 447
 391424375

@é

Page 448
 391424375

Page 449
 391424375

@)

Page 450
 391424375

@I

Page 451
 391424375

##0\);_("$"* "-"_);_(@_).))_(* #

an read trace files created.*delete tkprof binary from $ORACLE_HOME/binOtkprof is used to read trace files and should be used off the pro

Page 452
 391424375

s several ANY privsOSP22C04057049D
F974C2

tions. D
efault it has several CREATE privileges.PORTAL

18 February 2004>Alert 62

diting priority and can be done easilly. The more users who are likely to be affected by this then the less it should be done due to performan

a schema account from Oracle Applications. D
efault it has several CREATE privileges.IEOE93196E9196653F1[IEO is a schema account fro

Page 453
 391424375

al CREATE privileges.BLAKEPAPER9435F2E60569158EBLEWISC9B597D
7361EE067+BLEWIS is a schema owner of Workflow IasdbBO

from working.INVALID
E1BAE6D
95AA95F1EAURORA$ORB$UNAUTHENTICATED
80C099F0EAD
F877EBOLAPSYS is an administrative a

Oracle9i Application Server D
efault SOAP Configuration 9Alert 21

vices option.´Oracle Context allows a database user to access external files.

AGENTC5F0512A64EB0E7FNAMES9B95D
28A979CC5C4

e usernames and passwords that scripts are being run under may show when running the ps -ef command. This is a well known issue as an

Page 454
 391424375

Ð@HÂ

Page 455
 391424375

Ð@HÂ*

Page 456
 391424375

Ð@HÂJ

Ð@HÂ

Page 457
 391424375

Page 458
 391424375

Ð@HÂ*

Page 459
 391424375

Ð@HÂJ

Page 460
 391424375

Ð@HÂj

Page 461
 391424375

Ð@HŠ

Page 462
 391424375

Ð@Hª

Page 463
 391424375

Ð@HÂÊ

Page 464
 391424375

Ð@HÂê

Page 465
 391424375

Ð@HÂ

Page 466
 391424375

Ð@HÂ*

Page 467
 391424375

Ð@HÂJ

Page 468
 391424375

Ð@HÂj

Page 469
 391424375

Ð@HŠ

Page 470
 391424375

Ð@Hª

Page 471
 391424375

Ð@HÂÊ

Page 472
 391424375

Ð@HÂê

Page 473
 391424375

Ð@HÂ

Page 474
 391424375

Ð@HÂ*

Page 475
 391424375

Ð@HÂJ

Page 476
 391424375

##0_);_(* \(#

ME/binOtkprof is used to read trace files and should be used off the production server Remove tkprof from production db'Change sys passw

Page 477
 391424375

SSL Update for CERT CA-2003-26 and older SSL issues Rev 1

to be affected by this then the less it should be done due to performance hit.BFor example:

REATE privileges.IEOE93196E9196653F1[IEO is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IES

Page 478
 391424375

B597D
7361EE067+BLEWIS is a schema owner of Workflow IasdbBOM56D
B3E89EAE5788ERBOM is a schema account from Oracle App

THENTICATED
80C099F0EAD
F877EBOLAPSYS is an administrative account for the OLAP Services option.C1510E7AC8F0D
90D
OMWB_

Oracle Label Security Mandatory Security Patch 7Alert 20

nal files.

ow when running the ps -ef command. This is a well known issue as an attacker could simply read these credentials and then impersonate

Page 479
 391424375

”@

Page 480
 391424375

@õ+

Page 481
 391424375

@õK

Page 482
 391424375

”@

Page 483
 391424375

@õ+

Page 484
 391424375

@õK

Page 485
 391424375

@õk

Page 486
 391424375

@õ‹

Page 487
 391424375

@õ«

Page 488
 391424375

@õË

Page 489
 391424375

@õë

Page 490
 391424375

”@

Page 491
 391424375

@õ+

Page 492
 391424375

@õK

Page 493
 391424375

@õk

Page 494
 391424375

@õ‹

Page 495
 391424375

@õ«

Page 496
 391424375

@õË

Page 497
 391424375

@õë

Page 498
 391424375

”@

Page 499
 391424375

@õ+

Page 500
 391424375

@õK

Page 501
 391424375

##0\);_(* "-"_);_(@_)?

e production server Remove tkprof from production db'Change sys password and system passwordTie db accounts to usersôWith leaving s

Page 502
 391424375

04 D
ecember 2003EAlert 61

rmance hit.BFor example:

nt from Oracle Applications. D
efault it has several CREATE privileges.IES30802533AD
ACFE14[IES is a schema account from Oracle Appli

Page 503
 391424375

bBOM56D
B3E89EAE5788ERBOM is a schema account from Oracle Applications. D
efault it has several ANY privsSYSMAN447B72916119

tive account for the OLAP Services option.C1510E7AC8F0D
90D
OMWB_EMULATION54A85D
2A0AB8D
865ONT9E3C81574654100A[ONT

Oracle File Overwrite Security Vulnerability 9Alert 19

as an attacker could simply read these credentials and then impersonate that user.Ïhide.c available from oracle metalink support allows the

Page 504
 391424375

Г@ˆ

Page 505
 391424375

@õ

Page 506
 391424375

@õL

Page 507
 391424375

Г@ˆ

Page 508
 391424375

@õ

Page 509
 391424375

@õL

Page 510
 391424375

@õl

Page 511
 391424375

@õŒ

Page 512
 391424375

@õ¬

Page 513
 391424375

@õÌ

Page 514
 391424375

@õì

Page 515
 391424375

Г@ˆ

Page 516
 391424375

@õ

Page 517
 391424375

@õL

Page 518
 391424375

@õl

Page 519
 391424375

@õŒ

Page 520
 391424375

@õ¬

Page 521
 391424375

@õÌ

Page 522
 391424375

@õì

Page 523
 391424375

Г@ˆ

Page 524
 391424375

@õ

Page 525
 391424375

@õL

Page 526
 391424375

:_("$"* #

hange sys password and system passwordTie db accounts to usersôWith leaving staff and contract workers it is possible that there are acc

Page 527
 391424375

SQL Injection Vulnerability in Oracle9i Application Server Rev 3

ATE privileges.IES30802533AD
ACFE14[IES is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IEU5D

Page 528
 391424375

nt from Oracle Applications. D
efault it has several ANY privsSYSMAN447B729161192C24·SYSMAN is the management account for Oracle

8F0D
90D
OMWB_EMULATION54A85D
2A0AB8D
865ONT9E3C81574654100A[ONT is a schema account from Oracle Applications. D
efault

Oracle Trace Collection Security Vulnerability 6Alert 18

hen impersonate that user.Ïhide.c available from oracle metalink support allows the username/password to be hid from the ps -ef command

Page 529
 391424375

Г@

Page 530
391424375

Page 531
 391424375

`
“@M

Page 532
 391424375

Г@

Page 533
391424375

Page 534
 391424375

`
“@M

Page 535
 391424375

`
“@m

Page 536
 391424375

`
“@

Page 537
 391424375

`
“@

Page 538
 391424375

`
“@Í

Page 539
 391424375

`
“@í

Page 540
 391424375

Г@

Page 541
391424375

Page 542
 391424375

`
“@M

Page 543
 391424375

`
“@m

Page 544
 391424375

`
“@

Page 545
 391424375

`
“@

Page 546
 391424375

`
“@Í

Page 547
 391424375

`
“@í

Page 548
 391424375

Г@

Page 549
391424375

Page 550
 391424375

`
“@M

Page 551
 391424375

##0.00_);_("$"* \(#

rsôWith leaving staff and contract workers it is possible that there are accounts in the db that are not being used termed "dormant".

Page 552
 391424375

13 November 2003D
Alert 60

rom Oracle Applications. D
efault it has several CREATE privileges.IEU5D
0E790B9E882230[IEU is a schema account from Oracle Applicat

Page 553
 391424375

AN447B729161192C24·SYSMAN is the management account for Oracle Enterprise Mananger. It is used as access to all databases that ar

74654100A[ONT is a schema account from Oracle Applications. D
efault it has several CREATE privileges.OO2AB9032E4483FAFC

Oracle9iAS Web Cache Overflow Vulnerability BAlert 17

upport allows the username/password to be hid from the ps -ef command.

Page 554
 391424375

ð“@

Page 555
 391424375

`
“@-

Page 556
 391424375

p“@N

Page 557
 391424375

ð“@

Page 558
 391424375

`
“@-

Page 559
 391424375

p“@N

Page 560
 391424375

p“@n

Page 561
 391424375

p“@Ž

Page 562
 391424375

p“@®




Page 563
 391424375

p“@Î

Page 564
 391424375

p“@î

Page 565
 391424375

ð“@

Page 566
 391424375

`
“@-

Page 567
 391424375

p“@N

Page 568
 391424375

p“@n

Page 569
 391424375

p“@Ž

Page 570
 391424375

p“@®




Page 571
 391424375

p“@Î

Page 572
 391424375

p“@î

Page 573
 391424375

ð“@

Page 574
 391424375

`
“@-

Page 575
 391424375

p“@N

Page 576
 391424375

##0.00\);_("$"* "-"??_);_(@_)6+1_(* #

there are accounts in the db that are not being used termed "dormant".

Page 577
 391424375

Unauthorized Access to Restricted Content in Oracle Files Rev 1

ivileges.IEU5D
0E790B9E882230[IEU is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IEX6CC978

Page 578
 391424375

unt for Oracle Enterprise Mananger. It is used as access to all databases that are managed by it. It might be possible to access a data in yo

tions. D
efault it has several CREATE privileges.OO2AB9032E4483FAFC

Oracle Internet D
irectory Buffer Overflow Vulnerability SAlert 16

-ef command.

Page 579
 391424375

@õ

Page 580
 391424375

p“@.

Page 581
 391424375

@ˆý

Page 582
 391424375

@õ

Page 583
 391424375

p“@.

Page 584
 391424375

@O

Page 585
 391424375

@o

Page 586
 391424375

@

Page 587
 391424375

@¯

Page 588
 391424375

@Ï

Page 589
 391424375

@ï

Page 590
 391424375

@õ

Page 591
 391424375

p“@.

Page 592
 391424375

@O

Page 593
 391424375

@o

Page 594
 391424375

@

Page 595
 391424375

@¯

Page 596
 391424375

@Ï

Page 597
 391424375

@ï

Page 598
 391424375

@õ

Page 599
 391424375

p“@.

Page 600
 391424375

@O

Page 601
 391424375

##0.00_);_(* \(#

ant".

Page 602
 391424375

28 October 2003=Alert 59

racle Applications. D
efault it has several CREATE privileges.IEX6CC978F56D
21258D
[IEX is a schema account from Oracle Applications. D

Page 603
 391424375

bases that are managed by it. It might be possible to access a data in your databases.SYSTEM8BF0D
A8E551D
E1B9@SYSTEM is Oracle

FAFC

Oracle SQL*Net and Net8 Malformed Packet D
enial of Service Vulnerability AAlert 15

Page 604
 391424375

”@

Page 605
 391424375

@ˆ/

Page 606
 391424375

”@

Page 607
 391424375

@/

Page 608
 391424375

@P

Page 609
 391424375

@p

Page 610
 391424375

@

Page 611
 391424375

@°

Page 612
 391424375

@Ð

Page 613
 391424375

@ð

Page 614
 391424375

”@

Page 615
 391424375

@/

Page 616
 391424375

@P

Page 617
 391424375

@p

Page 618
 391424375

@

Page 619
 391424375

@°

Page 620
 391424375

@Ð

Page 621
 391424375

@ð

Page 622
 391424375

”@

Page 623
 391424375

@/

Page 624
 391424375

@P

Page 625
 391424375

##0.00\);_(* "-"??_);_(@_)¤"£"#

Page 626
 391424375

Buffer Overflow in Oracle D
atabase Server Binaries JAlert 58

X is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IFSSYS1D
F0D
45B58E72097>IFSSYS is an acc

Page 627
 391424375

YSTEM8BF0D
A8E551D
E1B9@SYSTEM is Oracles database management account. It allows to readD
_SYSPW1B9F1F9A5CB9EB31D
4D
F

Buffer Overflow Vulnerability in the Oracle8i Listener @Alert 14

Page 628
 391424375

@ˆ…

Page 629
 391424375

@0

Page 630
 391424375

@ˆ…

Page 631
 391424375

@0

Page 632
 391424375

@õQ

Page 633
 391424375

@õq

Page 634
 391424375

@õ‘

Page 635
 391424375

@õ±

Page 636
 391424375

@õÑ

Page 637
 391424375

@õñ

Page 638
 391424375

@ˆ…

Page 639
 391424375

@0

Page 640
 391424375

@õQ

Page 641
 391424375

@õq

Page 642
 391424375

@õ‘

Page 643
 391424375

@õ±

Page 644
 391424375

@õÑ

Page 645
 391424375

@õñ

Page 646
 391424375

@ˆ…

Page 647
 391424375

@0

Page 648
 391424375

@õQ

Page 649
 391424375

##0;\-"£"#

Page 650
 391424375

Buffer Overflow in the XML D
atabase of Oracle9i D
atabase Server Rev 1

eral CREATE privileges.IFSSYS1D
F0D
45B58E72097>IFSSYS is an account belonging to Oracle Internet File System.IGCD
33CEB8277F2

Page 651
 391424375

nagement account. It allows to readD
_SYSPW1B9F1F9A5CB9EB31D
4D
F7931AB130E372D
594E86F93B17A1

Oracle SQL*Net/Net8 D
enial of Service Vulnerabilities :Alert 13

Page 652
 391424375

P”@ˆ

Page 653
 391424375

@õ1

Page 654
 391424375

P”@

Page 655
 391424375

@õ1

Page 656
 391424375

@õR

Page 657
 391424375

@õr

Page 658
 391424375

@õ’

Page 659
 391424375

@õ²

Page 660
 391424375

@õÒ

Page 661
 391424375

@õò

Page 662
 391424375

P”@

Page 663
 391424375

@õ1

Page 664
 391424375

@õR

Page 665
 391424375

@õr

Page 666
 391424375

@õ’

Page 667
 391424375

@õ²

Page 668
 391424375

@õÒ

Page 669
 391424375

@õò

Page 670
 391424375

P”@

Page 671
 391424375

@õ1

Page 672
 391424375

@õR

Page 673
 391424375

##0¥"£"#

Page 674
 391424375

18 August 2003@Alert 57

nt belonging to Oracle Internet File System.IGCD
33CEB8277F25346[IGC is a schema account from Oracle Applications. D
efault it has seve

Page 675
 391424375

931AB130E372D
594E86F93B17A1

Oracle Redirect D
enial of Service Vulnerability U

Page 676
 391424375

@ý

Page 677
 391424375

@õ2

Page 678
 391424375

@ý

Page 679
 391424375

@õ2

Page 680
 391424375

¤¼@S

Page 681
 391424375

¤¼@s

Page 682
 391424375

¤¼@“

Page 683
 391424375

¤¼@³

Page 684
 391424375

¤¼@Ó

Page 685
 391424375

¤¼@ó

Page 686
 391424375

@ý

Page 687
 391424375

@õ2

Page 688
 391424375

¤¼@S

Page 689
 391424375

¤¼@s

Page 690
 391424375

¤¼@“

Page 691
 391424375

¤¼@³

Page 692
 391424375

¤¼@Ó

Page 693
 391424375

¤¼@ó

Page 694
 391424375

@ý

Page 695
 391424375

@õ2

Page 696
 391424375

¤¼@S

Page 697
 391424375

##0;[Red]\-"£"#

Page 698
 391424375

Buffer Overflows in EXTPROC of Oracle D
atabase Server Rev 2

CEB8277F25346[IGC is a schema account from Oracle Applications. D
efault it has several CREATE privileges.IGF1740079EFF46AB81[IGF

Page 699
 391424375

Buffer Overflow in Net Services for Oracle D
atabase Server Rev 2

Page 700
 391424375

¤¼@3

Page 701
 391424375

¤¼@3

Page 702
 391424375

¤¼@T

Page 703
 391424375

¤¼@t

Page 704
 391424375

¤¼@”

Page 705
 391424375

¤¼@´

Page 706
 391424375

¤¼@Ô

Page 707
 391424375

¤¼@ô

Page 708
 391424375

¤¼@3

Page 709
 391424375

¤¼@T

Page 710
 391424375

¤¼@t

Page 711
 391424375

¤¼@”

Page 712
 391424375

¤¼@´

Page 713
 391424375

¤¼@Ô

Page 714
 391424375

¤¼@ô

Page 715
 391424375

¤¼@3

Page 716
 391424375

¤¼@T

Page 717
 391424375

##0¦"£"#

Page 718
 391424375

07 August 20036869F3CFD
027983AD
SSYSE3B6E6006B3A99E0=D
SSYS is an account for Oracle D
ynamic Services/Web

D
efault it has several CREATE privileges.IGF1740079EFF46AB81[IGF is a schema account from Oracle Applications. D
efault it has severa

Page 719
 391424375

30 April 2003GAlert 53

Page 720
 391424375

¤¼@4

Page 721
 391424375

¤¼@4

Page 722
 391424375

@U

Page 723
 391424375

@u

Page 724
 391424375

@•

Page 725
 391424375

@µ

Page 726
 391424375

@Õ

Page 727
 391424375

@õ

Page 728
 391424375

¤¼@4

Page 729
 391424375

@U

Page 730
 391424375

@u

Page 731
 391424375

@•

Page 732
 391424375

@µ

Page 733
 391424375

@Õ

Page 734
 391424375

@õ

Page 735
 391424375

¤¼@4

Page 736
 391424375

@U•@ý

Page 737
 391424375

##0.00;\-"£"# ##0.00#§"£"#

Page 738
 391424375

Report Review Agent Vulnerability in Oracle E-Business Suite Rev 1 10 April 2003BAlert 52

Page 739
 391424375

@ˆ5 @6

Page 740
 391424375

@5 @6

Page 741
 391424375

@V @W

Page 742
 391424375

@v @w

Page 743
 391424375

@– @—

Page 744
 391424375

@¶ @·

Page 745
 391424375

@Ö @×

Page 746
 391424375

@ö @÷

Page 747
 391424375

@5 @6

Page 748
 391424375

@V @W

Page 749
 391424375

@v @w

Page 750
 391424375

@– @—

Page 751
 391424375

@¶ @·

Page 752
 391424375

@Ö @×

Page 753
 391424375

@ö @÷

Page 754
 391424375

@5 @6

Page 755
 391424375

##0.00;[Red]\-"£"# ##0.005¨0_-"£"* #

Page 756
 391424375

Security Vulnerabilities in Oracle9i Application Server Rev 3 03 March 2003KAlert 51

Page 757
 391424375

@7 ”@8

Page 758
 391424375

@7 ”@8

Page 759
 391424375

”@X Г@ˆY

Page 760
 391424375

”@x Г@ˆy

Page 761
 391424375

”@˜ Г@ˆ™

Page 762
 391424375

”@¸ Г@ˆ¹

Page 763
 391424375

”@Ø Ð“@ˆÙ

Page 764
 391424375

”@ø Г@ˆù

Page 765
 391424375

@7 ”@8

Page 766
 391424375

”@X Г@ˆY

Page 767
 391424375

”@x Г@ˆy

Page 768
 391424375

”@˜ Г@ˆ™

Page 769
 391424375

”@¸ Г@ˆ¹

Page 770
 391424375

”@Ø Ð“@ˆÙ

Page 771
 391424375

”@ø Г@ˆù

Page 772
 391424375

@7 ”@8

Page 773
 391424375

##0_-;\-"£"* # ##0_-;_-"£"* "-"_-;_-@_-

Page 774
 391424375

Buffer Overflow in ORACLE executable of Oracle9i D
atabase Server Rev 6 18 April 20036Alert 50

Page 775
 391424375

Г@ˆ9 Г@:

Page 776
 391424375

Г@ˆ9 Г@:

Page 777
 391424375

Г@Z ð“@[

Page 778
 391424375

Г@z ð“@{

Page 779
 391424375

Г@š ð“@›

Page 780
 391424375

Г@º ð“@»

Page 781
 391424375

Г@Ú ð“@Û

Page 782
 391424375

Г@ú ð“@û

Page 783
 391424375

Г@ˆ9 Г@:

Page 784
 391424375

Г@Z ð“@[

Page 785
 391424375

Г@z ð“@{

Page 786
 391424375

Г@š ð“@›

Page 787
 391424375

Г@º ð“@»

Page 788
 391424375

Г@Ú ð“@Û

Page 789
 391424375

Г@ú ð“@û

Page 790
 391424375

Г@ˆ9 Г@:

Page 791
 391424375

©'_-* #

Page 792
 391424375

Buffer Overflow in Oracle9i D
atabase Server 6Alert 49

Page 793
 391424375

ð“@;

Page 794
 391424375

ð“@;

Page 795
 391424375

@õ\

Page 796
 391424375

@õ|

Page 797
 391424375

@õœ

Page 798
 391424375

@õ¼

Page 799
 391424375

@õÜ

Page 800
 391424375

@õü

Page 801
 391424375

ð“@;

Page 802
 391424375

@õ\

Page 803
 391424375

@õ|

Page 804
 391424375

@õœ

Page 805
 391424375

@õ¼

Page 806
 391424375

@õÜ

Page 807
 391424375

@õü

Page 808
 391424375

ð“@;

Page 809
 391424375

##0_-;\-* #

Page 810
 391424375

Buffer Overflow in Oracle9i D
atabase Server 6Alert 48

Page 811
 391424375

@õ<

Page 812
 391424375

@õ<

Page 813
 391424375

”@]

Page 814
 391424375

”@}

Page 815
 391424375

”@

Page 816
 391424375

”@½

Page 817
 391424375

”@Ý

Page 818
 391424375

”@ý

Page 819
 391424375

@õ<

Page 820
 391424375

”@]

Page 821
 391424375

”@}

Page 822
 391424375

”@

Page 823
 391424375

”@½

Page 824
 391424375

”@Ý

Page 825
 391424375

”@ý

Page 826
 391424375

@õ<

Page 827
 391424375

##0_-;_-* "-"_-;_-@_-=ª8_-"£"* #

Page 828
 391424375

Buffer Overflow in Oracle9i D
atabase Server BAlert 47

Page 829
 391424375

”@=

Page 830
 391424375

”@=

Page 831
 391424375

@ˆ…^

Page 832
 391424375

@ˆ…~

Page 833
 391424375

@ˆ…ž

Page 834
 391424375

@ˆ…¾

Page 835
 391424375

@ˆ…Þ

Page 836
 391424375

@ˆ…þ

Page 837
 391424375

”@=

Page 838
 391424375

@ˆ…^

Page 839
 391424375

@ˆ…~

Page 840
 391424375

@ˆ…ž

Page 841
 391424375

@ˆ…¾

Page 842
 391424375

@ˆ…Þ

Page 843
 391424375

@ˆ…þ

Page 844
 391424375

”@=

Page 845
 391424375

##0.00_-;\-"£"* # ##0.00_-;_-"£"* "-"??_-;_-@_-4«/_-* #

Page 846
 391424375

Security Vulnerabilities in Oracle9i Application Server Rev 3 23 July 2003BAlert 46

Page 847
 391424375

@ˆ…> P”@ˆ?

Page 848
 391424375

@ˆ…> P”@?

Page 849
 391424375

P”@_ @ý

Page 850
 391424375

P”@ @ý

Page 851
 391424375

P”@Ÿ @ý

Page 852
 391424375

P”@¿ @ý

Page 853
 391424375

P”@ß @ý

Page 854
 391424375

P”@ÿ 
 @ý

Page 855
 391424375

@ˆ…> P”@?

Page 856
 391424375

P”@_ @ý

Page 857
 391424375

P”@ @ý

Page 858
 391424375

P”@Ÿ @ý

Page 859
 391424375

P”@¿ @ý

Page 860
 391424375

P”@ß @ý

Page 861
 391424375

P”@ÿ 
 @ý

Page 862
 391424375

@ˆ…> P”@?

Page 863
 391424375

##0.00_-;\-* #

Page 864
 391424375

Buffer Overflow in iSQL*Plus (Oracle9i D
atabase Server) Rev 3

Page 865
 391424375

@ý

Page 866
 391424375

@ý

Page 867
 391424375

@ý

Page 868
 391424375

@ý

Page 869
 391424375

##0.00_-;_-* "-"??_-;_-@_-¬
"Yes";"Yes";"No""True";"True";"False"®


"On";"On";"Off"]¯ [$¬
-2]\ #

Page 870
 391424375

11 November 2002 Alert 45

Page 871
 391424375

##0.00_);[Red]\([$¬
-2]\ #

Page 872
 391424375

Security Release of Apache 1.3.27 Rev 6

Page 873
 391424375

##0.00\)àõÿ 
(À àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ àõÿ 
 ôÀ à(À

Page 874
 391424375

20 May 2004TAlert 44

Page 875
 391424375

Unauthorized Access Vulnerability in Oracle E-Business Suite Release 11i Rev 1

Page 876
 391424375

04 October 2002QAlert 43

Page 877
 391424375

Oracle9iApplication Server Web Cache Administration Tool Vulnerability 9Alert 42

Page 878
 391424375

D
enial of Services Against Oracle Net Services Rev 3 16 D
ecember 2002QAlert 41

Page 879
 391424375

Oracle9iApplication Server Oracle Java Server Pages D
emo Vulnerability Rev 1 14 August 2002.Alert 40

Page 880
 391424375

Oracle Net Listener Vulnerabilities Rev 3 08 August 2002GAlert 39

Page 881
 391424375

Web Cache Oracle9i Application Server Password Vulnerability Rev 1 08 August 2002>Alert 38

Page 882
 391424375

Oracle Net D
enial of Service Security Vulnerability "Alert 37 OpenSSL Buffer Overflow VAlert 36

Page 883
 391424375

Security Vulnerability in Apache HTTP Server of Oracle9i Application Server EAlert 35

Page 884
 391424375

Buffer Overflow Vulnerability in Oracle9iAS Reports Server QAlert 34

Page 885
 391424375

Buffer Overflow Vulnerability in Oracle Net (Oracle9i D
atabase Server) D
Alert 33

Page 886
 391424375

User Privileges Vulnerability in Oracle9i D
atabase Server KAlert 32

Page 887
 391424375

Unauthorized Access Vulnerability in the Oracle E-business Suite AAlert 31

Page 888
 391424375

Oracle Configurator Cross Site Scripting Vulnerability ÍTripwire can be used to monitor

Page 889
 391424375

recorded and then checked at agreed intervals.½correlated log analysis is a growing requirement in large enterprises so that

Page 890
 391424375

over many systems. This may be a hack or a system failure. This requires synchronised time.schemapackageAlert 68Jan05Apr05July05Oct

Page 891
 391424375

packageAlert 68Jan05Apr05July05Oct05Jan06Apr06Jul06nowCATSEARCHfixedCTX_D
OCCTX_QUERYD
RID
D
LRD
RILOAD
D
RI_MOVE_

Page 892
 391424375

ERYD
RID
D
LRD
RILOAD
D
RI_MOVE_CTXSYSD
RVD
MLD
RVXMD
D
BMS_EXPFILMD
2PRVT_ID
XPRVT_SAMRTREE_ID
XSD
O_CATALOG

Page 893
 391424375

VT_SAMRTREE_ID
XSD
O_CATALOG SD
O_GEOR_INTSD
O_GEOR_UTLSD
O_GEOM_TRIG_INS1SD
O_LRS_TRIG_INSSD
O_PRID
XSD
O

Page 894
 391424375

D
O_LRS_TRIG_INSSD
O_PRID
XSD
O_SAMSD
O_TUNESD
O_UTILCWM2_OLAP_AW_AWUTILORD
IMAGEORD
IMGID
XMETHOD
SAQ_I

Page 895
 391424375

D
IMAGEORD
IMGID
XMETHOD
SAQ_INVD
BMS_APPLY_PROCESSD
BMS_APPLY_AD
M_INTERNALD
BMS_AQAD
M_SYSD
BMS_CD
C_D

Page 896
 391424375

LD
BMS_AQAD
M_SYSD
BMS_CD
C_D
PUTILD
BMS_CD
C_IMPD
PD
BMS_CD
C_ISUBSCRIBED
BMS_CD
C_SUBSCRIBED
BMS_CD
C_UTIL

Page 897
 391424375

CD
C_SUBSCRIBED
BMS_CD
C_UTILITY

Page 898