BugTraq
Bypassing Oracle dbms_assert Jul 27 2006 04:16PM
ak red-database-security com (1 replies)
Re: Bypassing Oracle dbms_assert Jul 28 2006 04:42AM
David Litchfield (davidl ngssoftware com) (1 replies)
> Today I released a new whitepaper "Bypassing Oracle dbms_assert".
<SNIP>
> Oracle has no problem with the release of this information
> ("Oracle sees no problem with your publication of the
> white paper.")

The reason Oracle sees no problem with the release of the paper is that for
your technique to work the DBMS_ASSERT.QUALIFIED_SQL_NAME has to be used in
the wrong context; you simply wouldn't use QUALIFIED_SQL_NAME in this
manner - i.e. within quotes. I've just had a quick look through the SYS
packages and find no instance of DBMS_ASSERT.QUALIFIED_SQL_NAME being used
this way. If there is such a case, in other words I've missed it, then it
would be a flaw in the package/procedure/function itslef and not a problem
with DBMS_ASSERT - with the fix being to use the correct DBMS_ASSERT
function instead of QUALIFIED_SQL_NAME or alternatively use a bind variable.

Cheers,
David

[ reply ]
RE: Bypassing Oracle dbms_assert Jul 28 2006 01:52PM
Alexander Kornbrust (ak red-database-security com) (1 replies)
Re: Bypassing Oracle dbms_assert Jul 28 2006 02:20PM
David Litchfield (davidl ngssoftware com)


 

Privacy Statement
Copyright 2010, SecurityFocus