Oracle ANSI join security bug. Bad news again.
Trying to figure out a workaround, I have found that these DMLs that break authorization, also can not be AUDIT TRAILED.
posted by Mark Malakanov at 5:36 AM
Here I sporadically post some notes about interesting (to me at least) Oracle, MSSQL, MySQL, OLAP and datawarehousing things....
posted by Mark Malakanov at 5:36 AM
1 Comments:
Hi Mark,
Agree with you – I observed the same issue with audit trail days ago. And, as you probably noticed, Oracle flatly refuses to audit those DML statements for any user, no matter if he has required modification privileges.
I still have my “severity 1” TAR open, and recently I notified Oracle Support about this and some other side-effects of original problem.
Though I discovered some new side-effects of that security hole in Oracle, I have decided not to publish this kind of information anymore because things are too serious to fiddle with them. Maybe you won’t agree with me, but I think that publishing any extra information is not for better in this situation.
In any case, I appreciate that you are treating this issue with high confidence, thank you for your understanding in this regard.
My sincere respect,
Andrew Max.
Post a Comment
<< Home