Still too many privileges granted to PUBLIC in 9.2.0.6

Lectori Salutem,
after the NIGHTMARE we had over here with applying patches for security alert #68 (hundreds of them) we started thinking more about 'hacking' and what else could cause database service disruptions. One of the things I am still worried about are to GRANTS to public after a database creation (9.2.0.6). See below:
SQL> L
  1 select privilege,owner,count(*) from dba_tab_privs   2* where grantee='PUBLIC' and owner='SYS' group by privilege,owner SQL> /

PRIVILEGE            OWNER                  COUNT(*)
-------------------- -------------------- ----------
DEBUG                SYS                          12
UNDER                SYS                           1
DELETE               SYS                           3
INSERT               SYS                           4
SELECT               SYS                         776
UPDATE               SYS                           2
EXECUTE              SYS                         443

A little test shows how easy it is to disrupt database service using a login that merely has create session priv.

1. create user test identified by dom; grant create session to test;
2. create user testdba identified by slim; grant connect,dba to testdba;
3. connect testdba/slim create table tabje (c1 number); insert into tabje values (1); commit; select * from tabje;
   >> row returned
   
4. start another session: connect test/dom exec sys.dbms_snapshot.BEGIN_TABLE_REORGANIZATION('TESTDBA','TABJE')

If TESTDBA in 4) tries to rerun the select now it hangs and never returns until user TEST in step 4 does commit or rollback

Fortunately this fails for objects required for warmstarting the database like SYS.OBJ$. ".ORA-00701: object necessary for warmstarting database cannot be altered"

I am quite sure that a little research in the list of sys owned plsql objects for which the grantee is PUBLIC will demonstrate more possibilities.

Please share comments.     

Kind regards,

André van Winssen

--
http://www.freelists.org/webpage/oracle-l