OraFAQ Forum: Security » PUBLIC Mistery

Home » RDBMS Server » Security » PUBLIC Mistery

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

PUBLIC Mistery [message #269384]

Fri, 21 September 2007 22:10

smunir362
Messages: 217
Registered: September 2007

Senior Member

AOA
Everybody would be with me in that
Oracle created a PUBLIC group by default and a lot of privs are granted to public. So any user creatd in database have all the privs which public have.
Is it mistery.

After that there may be possible SQL Injection through these privs. Why not oracle eliminate it or give the option to set it accordingly......
Am I right?

Munir
OCP DBA9i

Report message to a moderator

Re: PUBLIC Mistery [message #269386 is a reply to message #269384]

Fri, 21 September 2007 23:05

BlackSwan
Messages: 20108
Registered: January 2009

Senior Member

>Oracle created a PUBLIC group by default and a lot of privs are granted to public
>After that there may be possible SQL Injection through these privs.

Demonstrate how any vital security can be breached using default PUBLIC access via SQL injection or by direct access to database.

Report message to a moderator

Re: PUBLIC Mistery [message #269406 is a reply to message #269384]

Sat, 22 September 2007 01:31

Michel Cadot
Messages: 54223
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

And if you find some, then it's up to you to remove the privileges from PUBLIC.

Regards
Michel

Report message to a moderator

Re: PUBLIC Mistery [message #269435 is a reply to message #269406]

Sat, 22 September 2007 05:26

smunir362
Messages: 217
Registered: September 2007

Senior Member

AOA
Dear I know a lot of such hurdles that a PUBLIC has such privs to access the database.
Even an ordaniary user can become DBA . I have tested it. It is sure.

oracle critical patch best describe the vulnerabilities or security holes.
For more information u can check
http://red-database.com

Munir

Report message to a moderator

Re: PUBLIC Mistery [message #269459 is a reply to message #269435]

Sat, 22 September 2007 07:51

Michel Cadot
Messages: 54223
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Then apply CPU!

Regards
Michel

Report message to a moderator

Re: PUBLIC Mistery [message #269973 is a reply to message #269459]

Tue, 25 September 2007 05:00

smunir362
Messages: 217
Registered: September 2007

Senior Member

Applying CPU.......
Why But perhaps it is the only solution.....

But Why PUBLIC have so many privs by default.
I think it is useless.
We can use ROLES effectively.

Am i right?

Regards,

Report message to a moderator

Re: PUBLIC Mistery [message #269976 is a reply to message #269973]

Tue, 25 September 2007 05:02

Michel Cadot
Messages: 54223
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Remove the unused privileges. What's the problem with that?

Regards
Michel

Report message to a moderator

Re: PUBLIC Mistery [message #269979 is a reply to message #269976]

Tue, 25 September 2007 05:10

smunir362
Messages: 217
Registered: September 2007

Senior Member

Listing the unused privs is a great tiresome work. Alsmost it is very hard or even impossilble.
And we do not know what privs are?.....

Report message to a moderator

Re: PUBLIC Mistery [message #269997 is a reply to message #269979]

Tue, 25 September 2007 06:22

Michel Cadot
Messages: 54223
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

Remove all privileges from PUBLIC and see what is not working, then add the privilege and so on.
There you will be in the same situation than if there was no privilege to PUBLIC.
Isn't this what you want?

Regards
Michel

Report message to a moderator

Re: PUBLIC Mistery [message #270378 is a reply to message #269997]

Wed, 26 September 2007 12:58

smunir362
Messages: 217
Registered: September 2007

Senior Member

Yes it is ....a solution.
But I think it is not a comprehensive approach.

But my question was that "PUBLIC" is a mistery....

Why oracle include it with a lot of privs. Why it was necessary to include it......

Report message to a moderator

Re: PUBLIC Mistery [message #270384 is a reply to message #270378]

Wed, 26 September 2007 13:28

Michel Cadot
Messages: 54223
Registered: March 2007
Location: Nanterre, France, http://...

Senior Member
Account Moderator

History
Backward compatibility
Some packages defined with "authid current_user" need to be sure that anyone who has been granted the privilege to execute it can execute dependant packages
Lack of study on consequences
Laziness
...

4 and 5 lead to 2 in next versions and to 1 later.
This is the case now with some packages like UTL_FILE that are granted to PUBLIC but DB Console/Grid Control automatically reports them as hole of security.

Regards
Michel

Report message to a moderator