Re: Alter Any User

Question

My case is that when I have created a user and only granted the "CREATE SESSION" privilege, such user already can alter other users. The same happened to all other newly-created users. I have disabled the "ALTER" command in SQL*Plus as a provisional measure. But I suspect that some other DBA (we've got several DBAs) may have granted the "ALTER USER" privilege to PUBLIC accidentally. How can I know what system privileges (or even object privileges) have been granted to PUBLIC? I just want to find out what has happened before I attempt to revoke the privilege from PUBLIC.
First, technical questions such as this need to be
addressed to one of the technical forums. Products |
Database | Database - General would be appropriate
here.
If your DBA has granted a user other than the DBA the
"ALTER ANY USER" privilege, I would hope that the DBA
had done a significant security analysis and was
comfortable granting this privilege to this user.
ALTER ANY USER is certainly not a privilege most
users should have.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC
It's incredible that a non-dba user is able to alter
any user including sys and system by changing its
password, locking/unlocking it and ...
I'm using 8.1.7. Can it be solved?

Answer 1

You should be able to query the data dictionary table dba_sys_privs to see the privileges granted to PUBLIC.
SELECT grantee, privilege
  FROM dba_sys_privs
WHERE grantee='PUBLIC';If someone has mistakenly given PUBLIC the ALTER USER privilege, I would strongly recommend revoking that particular grant.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC