Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
Oracle Fine Grained Auditing Issue in Oracle 9i / 10g

Name Oracle Fine Grained Auditing Issue in Oracle 9i / 10g
Systems Affected Oracle Database 9i / 10g
Severity Medium Risk
Category Auditing disabled
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
Date 02 May 2005 (V 1.01)
US-CERT VU# 777773


Details
Fine grained audit (FGA) does not work if the user SYS runs a SELECT statements. There are 2 issues. The SELECT statement issued by SYS is not audited.
Once SYS selects the table all subsequent SELECTs by other users are NOT audited.

Testcase

1. Create user and objects and add policy
connect /as sysdba
grant dba to fga identified by fga;
conn fga/fga
create table emp as select * from scott.emp;
execute dbms_fga.add_policy(object_schema=>'FGA',
object_name=>'EMP',policy_name=>'FGA_POLICY');

2. Run SQL from fga user
conn fga/fga
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row.

3. Run SQL from SYS user
conn /as sysdba
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row which was obtained by step 2.

A new row was not inserted.

4. Run SQL from fga user again

conn fga/fga
select count(*) from fga.emp;
select sql_text,to_char(timestamp,'HH24:MI:SS') time
from sys.dba_fga_audit_trail;

--> It will return 1 row which was obtained by step 2.

A new row was not inserted again.

Patch Information
Apply patchset 10.1.0.4. for Oracle 10g.
This bug is not fixed in 9.2.0.6 with the latest patches from Oracle Critical Patch Update April 2005 applied.

History
17-feb-2004 Oracle logged and published this bug in Metalink (Bugid: 3450991)
28-mar-2005 Oracle release patchset 10.1.0.4 (for Linux)
05-may-2005 US CERT VU# added (V1.01)



2005 by Red-Database-Security GmbH - last update 04-nov-2005

Oracle HTMLDB

Oracle HTML DB is a rapid web application development tool for the Oracle database.

Using only a web browser and limited programming experience, you can develop and deploy professional-looking applications that are both fast and secure.