I chatted with Alex Gorbachev on email about this issue, privet Alex! and today he has posted the issue to his blog in a post titled http://www.pythian.com/blogs/352/calling-definer-rights-procedure-as-sysdba-security-hole - (broken link) Calling Definer-Rights Procedure as SYSDBA - Security Hole?. This is summed up as an issue where SYS AS SYSDBA seems to default to invoker rights irrespective of whether the procedure it is executing is definer rights. See Alex's examples for details. I suggested some further tests to Alex to find out if its a SYS issue as well and also to create the definer rights procedure as the lower level user rtaher than as SYS owned by the other user (shouldnt matter). I am not convinced its a security issue as the issue is with SYS AS SYSDBA so you canot escalate higher than that.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "new paper on oracle as sysdba connection weakness"] [Next entry: "Critical Patch Update January 2007 is out"]
January 2007
- Stealing Oracle passwords from the wire - 01/01/2007 by 01/01/2007
- A good blog to watch for Oracle internals and hard to find info - 01/03/2007 by 01/03/2007
- 10 steps to creating your own security audit - 01/04/2007 by 01/04/2007
- Teaching an Old Dog New Tricks - 01/05/2007 by 01/05/2007
- Great paper on Oracle Applications 11i password weaknesses and decryption - 01/10/2007 by 01/10/2007
- Oracle have announced a CPU pre-release feature - 01/12/2007 by 01/12/2007
- Oracle emulates Microsoft with advance patch notice - 01/14/2007 by 01/14/2007
- new paper on oracle as sysdba connection weakness - 01/15/2007 by 01/15/2007
- Critical Patch Update January 2007 is out - 01/16/2007 by 01/16/2007
- Details Oracle Critical Patch Update January 2007 - V1.02 released - 01/18/2007 by 01/18/2007
- Toolkit of generators and brute force tools - 01/19/2007 by 01/19/2007
- Secure Passwords Keep You Safer - 01/21/2007 by 01/21/2007
- Oracle password crackers just got faster - 01/22/2007 by 01/22/2007
- Transparent Data Encryption (TDE) certified for Apps 11i - 01/24/2007 by 01/24/2007
- Download some free chapters from the Oracle Hackers Handbook - 01/30/2007 by 01/30/2007
- BBED - Oracle Block Browser and EDitor - A hacker tool? - 01/31/2007 by 01/31/2007
Archives
Syndication
Powered by gm-rss 2.0.0
