Fwd: is it ok to tighten up extproc security?

From: Dan Norris <dannorris_at_dannorris.com>
Date: Fri, 14 Nov 2008 09:51:28 -0500
Message-ID: <bc04324b0811140651u62dacac8nce2c00d78e2b711@mail.gmail.com>

Sounds like everyone's recommending just removing it. Just in case you're the one site using extproc callouts, you might want to check dba_libraries to see if any have been registered. I'm not positive that an empty dba_libraries means that you're in the clear, but I'm pretty sure you'll see some obviously custom entries in there if someone has created a library for callouts.

I don't believe that Peoplesoft uses any extproc callouts (it sort of violates their "database-independent implementation" style).

Of course, you could just comment it out and wait for the phone to ring. That's probably what I'd do :).


On Fri, Nov 14, 2008 at 2:51 AM, Douglas Cowles <dcowles_at_us.ibm.com> wrote:

> My first question is how can I determine whether there are any external
> procs being used in the database in the first place. I would figure it
> would require a library, but all the libraries I have in the database are
> owned by sys and don't seem user generated even for Peoplesoft purposes. I
> would imagine I could turn this off but someone must have modified the
> listener at some point to allow extproc in the first place which makes me
> think someone wanted
> to do it but when and for what. It could have been set up 3 years ago.

Received on Fri Nov 14 2008 - 08:51:28 CST

Original text of this message