Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Oracle Rootkit 2.0: pinning ?
        
(Message started by: Pete Finnigan on Jul 19^th, 2007, 9:07am)

Title: Oracle Rootkit 2.0: pinning ?
Post by Pete Finnigan on Jul 19^th, 2007, 9:07am

hello all & Alex.

I read the whitepaper about "Oracle Rootkit 2.0", and i think the ideas about PINNING is not correct:
"Changed objects are NOT automatically reloaded if they are changed."

As I know, Oracle will reload automatically when PINED object is changed.

Would i miss something. Please, help me clarify it.

sys@TEST> create or replace function f1 return number is
2 begin
3 return 1;
4 end;
5 /

Function created.

sys@TEST> select f1 from dual
2 /

F1
----------
1

sys@TEST> exec sys.dbms_shared_pool.keep('F1')

PL/SQL procedure successfully completed.

sys@TEST> select name, pins, kept from v$db_object_cache where name='F1'
2 /

NAME PINS KEP
------------------------------ ---------- ---
F1 0 YES

sys@TEST> create or replace function f1 return number is
2 begin
3 return 3;
4 end;
5 /

Function created.

sys@TEST> select f1 from dual
2 /

F1
----------
3 <== It's 3, not 1

sys@TEST>