Oracle E-Business suite wide open to database attack Clear some time in you diary and drink an extra coffee, sysadmins: a top hacker has warned that Oracle will tomorrow patch a horror bug that needs urgent attention. Datacom TSS hacker David Litchfield told The Reg he has reported to Oracle that versions of its E-Business suite contain a "major" misconfiguration flaw that …
Functions called in function-based indexes cannot be used to perform any DML or DDL so although the function called by a function-based index on DUAL runs under SYS, it is very restricted in what it is allowed to do. The article suggests that you can use this method to run any old function under the SYS user. You can't.
You *can* execute DML and DDL. First create a function and specify pragma autonomous transaction... Place your execute immediate 'grant dba to public' in the function then call the function. I've been doing this for years and I know what I'm talking about :)
Cheers,
David Litchfield
DUAL has been around since I can remember (V4), and probably before, it's use was, and probably still is deeply embedded in virtually every Oracle application both overtly and covertly. Originally there wasn't much you could do with DUAL, apart from SELECT 1 FROM DUAL, the whole point being that it's a table with one empty row, was very useful when doing procedural stuff in early versions of Oracle Forms and SQL*PLUS, before the advent of PL/SQL. (I seem to remember some PL/SQL actually compiled to SELECT FROM DUAL) You did not insert into it, update it or delete from it, unless you wanted to crash your application, it was something every developer knew, not to touch.
I suspect that, in these enlightened days, no one actually uses it, and that it remains only for compatibility, quietly forgotten about, and not maintained by anyone.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
