The Oracle Hacker's Handbook: Hacking and Defending Oracle by Litchfield David

Author:Litchfield, David [Litchfield, David]
Language: eng
Format: mobi, epub
Publisher: Wiley
Published: 2007-01-29T16:00:00+00:00

What’s happening here is that we stick our nefarious code into an exception block so when an exception occurs our code executes — in this case, granting DBA privileges to PUBLIC. Oracle attempted to fix this in Alert 68 but failed. Here’s the function prototype:

Here’s how Oracle attempted to fix it. They performed a check to determine whether TYPE_SCHEMA is valid, as the sample code I sent them in my initial report injected into the TYPE_SCHEMA. Oracle added the following check to ensure that the schema is valid:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.