Pete Finnigan's Oracle Security Forum (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
Oracle Security >> Oracle Security >> Oracle Rootkit 2.0: pinning ?
(Message started by: Pete Finnigan on Jul 19th, 2007, 9:07am)

Title: Oracle Rootkit 2.0: pinning ?
Post by Pete Finnigan on Jul 19th, 2007, 9:07am
hello all & Alex.

I read the whitepaper about "Oracle Rootkit 2.0", and i think the ideas about PINNING is not correct:
"Changed objects are NOT automatically reloaded if they are changed."

As I know, Oracle will reload automatically when PINED object is changed.

Would i miss something. Please, help me clarify it.

sys@TEST> create or replace function f1 return number is
 2  begin
 3     return 1;
 4  end;
 5  /

Function created.

sys@TEST> select f1 from dual
 2  /

       F1
----------
        1

sys@TEST> exec sys.dbms_shared_pool.keep('F1')

PL/SQL procedure successfully completed.

sys@TEST> select name, pins, kept from v$db_object_cache where name='F1'
 2  /

NAME                                 PINS   KEP
------------------------------ ---------- ---
F1                                            0  YES

sys@TEST> create or replace function f1 return number is
 2  begin
 3     return 3;
 4  end;
 5  /

Function created.

sys@TEST> select f1 from dual
 2  /

       F1
----------
        3                         <== It's 3, not 1

sys@TEST>




Powered by YaBB 1 Gold - SP 1.4!
Forum software copyright © 2000-2004 Yet another Bulletin Board