security news in oracle 8?

From: Karen Abgarian <karen.abgarian_at_fmr.com>
Date: Tue, 14 Sep 1999 09:09:13 -0400
Message-ID: <37DE48F8.B93314C7@fmr.com>

Hi

I am trying this test on Oracle 8.0.5.1. on Solaris:

Under account U1 I create a view based on another user's table. Then I am
trying to grant the SELECT privilege on this view to someone else. In Oracle7
you needed the GRANT OPTION on the base table. It still works if I have a
GRANT OPTION in Oracle8.

But it also works without GRANT OPTION, if user U1 has SELECT ANY TABLE system privilege.

See attached log:

SQL> conn system
Connected.
SQL> create user test2 identified by test2;

User created.

SQL> grant connect to test2;

Grant succeeded.

SQL> alter user test2 quota unlimited on system;

User altered.

SQL> create user test1 identified by test1;

User created.

SQL> grant connect to test1;

Grant succeeded.

SQL> conn test2/test2
Connected.
SQL> create table test(n number);

Table created.

SQL> grant select on test to test1;

Grant succeeded.

SQL> conn test1/test1
Connected.

SQL> create view test as select * from test2.test;

View created.

SQL> grant select on test to system;
grant select on test to system

                *

ERROR at line 1:
ORA-01720: grant option does not exist for 'TEST2.TEST'

SQL> conn system
Connected.
SQL> grant select any table to test1;

Grant succeeded.

SQL> conn test1/test1
Connected.
SQL> grant select on test to system;

Grant succeeded.

SQL> spool off

Regards,
Karen Abgarian. Received on Tue Sep 14 1999 - 08:09:13 CDT