Oracle-L: RE: Is Statspack a Security Problem?

From: kkennedy <kkennedy_at_firstpoint.com>
Date: Wed, 24 Jul 2002 09:23:45 -0800
Message-ID: <F001.004A11B3.20020724092345@fatcity.com>

Sounds like yet another good reason for using bind variables 8-) Kevin Kennedy
First Point Energy Corporation

-----Original Message-----
Sent: Wednesday, July 24, 2002 8:23 AM
To: Multiple recipients of list ORACLE-L

To wit:
$grep -i grant spctab.sql

grant select       on STATS$SNAPSHOT_ID  to  PUBLIC;
grant select on        STATS$DATABASE_INSTANCE  to  PUBLIC;
grant select on        STATS$SNAPSHOT  to  PUBLIC;
grant select on        STATS$FILESTATXS  to  PUBLIC;
grant select on        STATS$TEMPSTATXS  to  PUBLIC;
grant select on        STATS$LATCH  to  PUBLIC;
grant select on        STATS$LATCH_CHILDREN  to  PUBLIC;
grant select on        STATS$LATCH_PARENT  to  PUBLIC;
grant select on        STATS$LATCH_MISSES_SUMMARY  to  PUBLIC;
grant select on        STATS$LIBRARYCACHE  to  PUBLIC;
grant select on        STATS$BUFFER_POOL_STATISTICS  to  PUBLIC;
grant select on        STATS$ROLLSTAT  to  PUBLIC;
grant select on        STATS$ROWCACHE_SUMMARY  to  PUBLIC;
grant select on        STATS$SGA    to  PUBLIC;
grant select on        STATS$SGASTAT  to  PUBLIC;
grant select on        STATS$SYSSTAT  to  PUBLIC;
grant select on        STATS$SESSTAT  to  PUBLIC;
grant select on        STATS$SYSTEM_EVENT  to  PUBLIC;
grant select on        STATS$SESSION_EVENT  to  PUBLIC;
grant select on        STATS$BG_EVENT_SUMMARY  to  PUBLIC;
grant select on        STATS$WAITSTAT  to  PUBLIC;
grant select on        STATS$ENQUEUESTAT  to  PUBLIC;
grant select on        STATS$SQL_SUMMARY  to  PUBLIC;
grant select on        STATS$SQLTEXT  to  PUBLIC;
grant select on        STATS$SQL_STATISTICS  to  PUBLIC;
grant select on        STATS$LEVEL_DESCRIPTION   to  PUBLIC;
grant select on        STATS$IDLE_EVENT   to  PUBLIC;
grant select on        STATS$PARAMETER  to  PUBLIC;
grant select on        STATS$STATSPACK_PARAMETER  to  PUBLIC;
-----------------------------------------------------------------------------------------------

Notice the grants on stats$sqltext and stats$sql_summary. Should anyone who logs into the database be able to see nearly SQL run against it. Oracle appears to truncate alter user statements so that one cannot find 'alter user blatz identified by password;' but one may stumble on update sal_table set sal = 100 where empoyee_id = 5;' or something to that effect.

Ian MacGregor
Stanford Linear Accelerator Center
ian_at_SLAC.Stanford.edu

--

Please see the official ORACLE-L FAQ: http://www.orafaq.com
--

Author: MacGregor, Ian A.
INET: ian_at_SLAC.Stanford.EDU

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
--

Please see the official ORACLE-L FAQ: http://www.orafaq.com
--

Author: kkennedy
INET: kkennedy_at_firstpoint.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------