 |
|
Oracle Forensics tips by Paul Wright
|
dbms_cdc_impdp is vulnerable to PLSQL Injection
like many other PLSQL packages in Oracle.
CPUs sometimes take away PUBLIC privileges on
vulnerable packages in order to protect them from general abuse
whilst allowing SYS to carry on using them. This means that they
cannot be accessed by PUBLIC but they are still vulnerable. Access
to the vulnerability could be introduced via the FLASHBACK DATABASE
command as shown below.
Will flashback DB revert privileges on an
object?
conn
system/manager@orcl
desc dbms_cdc_impdp;
PROCEDURE BUMP_SCN
Argument Name
Type In/Out Default?
------------------------------ ----------------------- ------
--------
NEW_SCN NUMBER IN
PROCEDURE BUMP_SEQUENCE
Argument
Name Type In/Out Default?
SQL> select grantee from
dba_tab_privs where table_name ='DBMS_CDC_IMPDP';
GRANTEE
------------------------------
PUBLIC
SQL> select
dbms_flashback.get_system_change_number SCN from dual;
SCN
----------
5162256
SQL> CONN SYS/ORCL@ORCL AS
SYSDBA
Connected.
SQL> REVOKE EXECUTE ON
DBMS_CDC_IMPDP FROM PUBLIC;
Revoke succeeded.
SQL> select grantee from
dba_tab_privs where table_name ='DBMS_CDC_IMPDP';
no rows selected
SQL> COMMIT;
Commit complete.
SQL> select
dbms_flashback.get_system_change_number SCN from dual;
SCN
----------
5162384
shutdown immediate
STARTUP MOUNT EXCLUSIVE;
FLASHBACK DATABASE TO SCN 5162256
ALTER DATABASE OPEN RESETLOGS;
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> STARTUP MOUNT EXCLUSIVE;
ORACLE instance started.
Total System Global Area
167772160 bytes
Fixed Size
1218316 bytes
Variable Size
79694068 bytes
Database Buffers
83886080 bytes
Redo Buffers
2973696 bytes
Database mounted.
SQL> FLASHBACK DATABASE TO SCN
51622562 ;
Flashback complete.
SQL> ALTER DATABASE OPEN
RESETLOGS;
SQL> select grantee from
dba_tab_privs where table_name ='DBMS_CDC_IMPDP';
GRANTEE
------------------------------
PUBLIC
Vulnerable and accessible again! Therefore a
CPU might need re-applying after a FLASHBACK command as well as
normal recovery, restore and major patch set upgrades.
This is an excerpt from the book "Oracle
Forensics: Oracle Security Best Practices", by Paul M. Wright,
the father of Oracle Forensics.
