Pete Finnigan's Oracle Security Weblog

I saw that David had made a couple of good posts to his blog in the last couple of days. The first is about the hidden parameter _dbms_sql_security_level being added to help control the use of the DBMS_SQL package and also to prevent cursor injection or cursor snarfing by adding security levels, checking effective and actual user IDs and also now generating random cursor ID's to prevent prediction. These are great improvements to this area that effectively closes out a major security hole. David's blog is titled Oracle 11g DBMS_SQL Security Changes.

David's second interesting post is titled 0wned by the lowly Oracle rowid pseudo function? and discusses the use of the ROWID function to predict information that is there but is perhaps not visible because of the use of VPD. This could undermine VPD in some circumstances but would require predictable other data to enable someone with SQL access to use the ROWID function to predict missing records. What is intersting about this post is that it uses the same method I suggested around 4 years ago but from another angle. I used it in Oracle forensics to show how a deleted record from SYS.AUD$ could be identified and also how altered records showed up in the same table when comparing the ROWID and also the timestamps.