Re: How to get version of server connected to without sys authority?

From: Pete Finnigan <plsql_at_petefinnigan.com>
Date: Thu, 11 Mar 2004 15:11:28 +0000
Message-ID: <qWaat2AgGIUARx3z@peterfinnigan.demon.co.uk>

Hi,

Use PL/SQL in your Pro*C embedded statement and use dbms_utility.db_version as follows:

SQL> set serveroutput on size 1000000
SQL> l
  1 declare

  2     lv_version varchar2(100):='';
  3     lv_compat  varchar2(100):='';
  4  begin
  5     dbms_utility.db_version(lv_version,lv_compat);
  6     dbms_output.put_line('version = '||lv_version);
  7     dbms_output.put_line('compatability = '||lv_compat);
  8  exception
  9     when others then
 10             dbms_output.put_line(sqlerrm);

 11* end;
SQL> /
version = 9.2.0.1.0
compatability = 9.2.0.0.0

PL/SQL procedure successfully completed.

SQL>
Running my privilege check script for dbms_utility it is available for public use:

who_can_access: Release 1.0.0.0.0 - Production on Thu Mar 11 15:09:27 2004
Copyright (c) 2004 PeteFinnigan.com Limited. All rights reserved.

get user input

NAME OF OBJECT TO CHECK [USER_OBJECTS]: dbms_utility
OWNER OF THE OBJECT TO CHECK    [USER]: sys
OUTPUT METHOD Screen/File          [S]: 
FILE NAME FOR OUTPUT        [priv.lst]: 
OUTPUT DIRECTORY                [/tmp]: 

Checking object => SYS.DBMS_UTILITY

---

Object type is => PACKAGE (TAB)

        Privilege => EXECUTE is granted to =>
                Role => PUBLIC

PL/SQL procedure successfully completed.

For updates please visit http://www.petefinnigan.com/tools.htm

SQL> Therefore you can use it as any user not SYS.

hth

kind regards

Pete

-- 
Pete Finnigan
email:pete_at_petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.

Received on Thu Mar 11 2004 - 09:11:28 CST