Oracle-L: RE: Upgrade from 9.0.1.2

From: <Cherie_Machler_at_gelco.com>
Date: Wed, 03 Jul 2002 07:17:56 -0800
Message-ID: <F001.0048EBC0.20020703071756@fatcity.com>

Does anyone have the bug number on this security bug?

Thanks,

Cherie Machler
Oracle DBA
Gelco Information Network

                                                                                                                 
                    Connor                                                                                       
                    McDonald             To:     Multiple recipients of list ORACLE-L <ORACLE-L_at_fatcity.com>     
                    <hamcdc_at_yahoo.       cc:                                                                     
                    co.uk>               Subject:     RE: Upgrade from 9.0.1.2 - NOPE!                           
                    Sent by:                                                                                     
                    root_at_fatcity.c                                                                               
                    om                                                                                           
                                                                                                                 
                                                                                                                 
                    07/02/02 01:04                                                                               
                    PM                                                                                           
                    Please respond                                                                               
                    to ORACLE-L

I'm pretty sure this has not been done...

NOBODY(!) should be on 9012 in production - unless you're happy with zero security. As well as the reading-anything as Ian points out, with a little bit of playing around its also possible to destroy any data in the database (since a view is updatable if it is formed correctly)

"Can't break it, can't break in".... Hmmmmmmmmmm :-)

hth
Connor

"MacGregor, Ian A." <ian_at_SLAC.Stanford.EDU> wrote: > Did Oracle back port the patch to fix the ANSI-style
> jonn bug to 9.0.1.2? This bug allows one to read any
> table in the database despite the permission set.
>
> Ian MacGregor
> Stanford Linear Accelerator Center
> oan_at_slac.stanford.edu
>
> -----Original Message-----
> Sent: Tuesday, July 02, 2002 8:23 AM
> To: Multiple recipients of list ORACLE-L
>
>
> Hi,
>
> We are currently testing our application on 9.0.1.2
> and it looks stable except some bugs with function
> based indexes.
> Is it advisable to move to 9.0.1.3 (as it is
> terminal release of 9.0) or 9.2 which is just
> released 2 months back (and may have some bugs)....
> OR 9.0.1.2 is stable enough and we can ship our
> product on this release. Any feedback on 9.0.1.2 is
> highly appreciated....
> Function based index bugs are not fixes in either of
> release.
> Platform are sun 2.8 and WIN2K....
> We have to make decision this week to give QA enough
> time for testing........
>
> Thanks
> --Harvinder
> --
> Please see the official ORACLE-L FAQ:
> http://www.orafaq.com
> --
> Author: Harvinder Singh
> INET: Harvinder.Singh_at_MetraTech.com
>
> Fat City Network Services -- (858) 538-5051 FAX:
> (858) 538-5051
> San Diego, California -- Public Internet
> access / Mailing Lists
>

> To REMOVE yourself from this mailing list, send an
> E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of
> 'ListGuru') and in
> the message BODY, include a line containing: UNSUB
> ORACLE-L
> (or the name of mailing list you want to be removed
> from). You may
> also send the HELP command for other information
> (like subscribing).
> --
> Please see the official ORACLE-L FAQ:
> http://www.orafaq.com
> --
> Author: MacGregor, Ian A.
> INET: ian_at_SLAC.Stanford.EDU
>
> Fat City Network Services -- (858) 538-5051 FAX:
> (858) 538-5051
> San Diego, California -- Public Internet
> access / Mailing Lists
>

> To REMOVE yourself from this mailing list, send an
> E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of
> 'ListGuru') and in
> the message BODY, include a line containing: UNSUB
> ORACLE-L
> (or the name of mailing list you want to be removed
> from). You may
> also send the HELP command for other information
> (like subscribing).

Connor McDonald
http://www.oracledba.co.uk
http://www.oaktable.net

"Remember amateurs built the ark - Professionals built the Titanic"

Do You Yahoo!?
Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: =?iso-8859-1?q?Connor=20McDonald?=
  INET: hamcdc_at_yahoo.co.uk

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).




-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.com
-- 
Author: 
  INET: Cherie_Machler_at_gelco.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).

Received on Wed Jul 03 2002 - 10:17:56 CDT