Pete Finnigan's Oracle Security Weblog

Today Alex Kornbrust has issued two new Oracle security advisories. These, like the last three issues on 26 May 2005 are not fixed as part of any Oracle released security advisory. Alex has found these two bugs in Metalink as part of his research for his "hacking metalink" article that is soon to be published. Alex has decided to publish these two advisories as the information for these bugs has been public for months. His Published Security Alerts page has been updated today 02-May-2005.

The first advisory "Fine Grained Auditing issue in Oracle 9i / 10g". The issue is where a SELECT is performed as SYS. There are two problems, the first is that the select statement as SYS is not audited and the second is that subsequent selects by any other user are also not audited. Alex goes on to show example code to demonstrate the issue. He also gives two workarounds, the first, do not run SQL on FGA objects as SYS and also flush the shared pool to activate auditing again. The second could give disadvantages to performance on the database.

The second advisory is "DBMS_SCHEDULER 10g SELECT user issue in Oracle 10g". This issue is that a user with CREATE JOB can run any job and after he has done so he has had the session_user switched to SYS. Alex gives example exploit code based on that available from metalink.

The big question is why were security advisories not made available from Oracle for these issues when they were fixed?