Introduction In the live sessions where I talk about Oracle Database security and vulnerabilities, I do always mention rootkits or malwares that can attack a database from either inside (via SQL injection, PL/SQL poisoning, Java leaks, etc) or externally (by changing oracle user files, such as binaries / libs / crontab / etc). To explore …
May 29
How to bypass requirement of WITH GRANT OPTION on views accessing third-party tables
A long time back, Oracle introduced limitations on VIEWS to avoid that some user with access to a given object in the database to pass on its contents to another user, by encapsulating it on views. As it's always better to show examples than writing theory, let's say we have 3 users on the database …
May 10
Dissecting 180417 BP, PSU, RU and RUR
Since Oct-2017 I am quarterly writing a post dissecting the changes implemented by Oracle CPUs so we can understand better the modifications implemented by Oracle in our Databases. So what oracle internal objects were changed in 180417? VERSION PATCH OWNER TYPE TOTAL -------------------- ---------- ------------------------------ ------------------------------ ---------- 12.1.0.2 BP SYS PACKAGE 1 12.1.0.2 BP SYS …
May 08
Oracle 12.2.0.1 JAN2018 RUR - 180417 or 180411 ?
After some delay, Oracle finally released in the end of April the First RUR for 12.2.0.1 Jan-2018 RU. The original release date for this RUR was April 17, 2018 but it was only really available around April 30, 2018. The problem is that because of this delay something get internally messed and instead of using …
Apr 25
New DBMS_ASH and DBMS_BDSQL packages - Apr2018 Patch
After applying the 180417 PSU and BP over 12.1.0.2 Database, I've noted 2 new packages created on the database: DBMS_ASH and DBMS_BDSQL. VERSION PATCH OWNER TYPE NAME -------------------- ---------- -------------------- -------------------- -------------------- 12.1.0.2 PSU & BP SYS PACKAGE DBMS_ASH 12.1.0.2 BP ONLY SYS PACKAGE DBMS_BDSQL 12.1.0.2 BP ONLY SYS PACKAGE BODY DBMS_ASH 12.1.0.2 BP ONLY …