Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> procedure in package body and not declares
        
(Message started by: Pete Finnigan on Nov 30^th, 2009, 10:47pm)

Title: procedure in package body and not declares
Post by Pete Finnigan on Nov 30^th, 2009, 10:47pm

maybe a stupid question...
theoretically possible to exist a method to call procedure from package body when this rpocedure is not declared in package?

P.S Sorry for my bad english (me+google translate ) ;D

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 1^st, 2009, 10:11pm

Only from within the package.

Code:

PACKAGE pack_1
proc_1
END;

PACKAGE BODY pack_1
proc_2
proc_1
END;

proc_2 can only be called from within the body of pack_1 (and not through dynamic SQL).

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 4^th, 2009, 7:09pm

on 12/01/09 at 22:11:24, gamyers wrote:

Only from within the package.

Code:

PACKAGE pack_1
proc_1
END;

PACKAGE BODY pack_1
proc_2
proc_1
END;

proc_2 can only be called from within the body of pack_1 (and not through dynamic SQL).

Thanks gamyers
I know about the fact that the procedures in the body of the package perform each other, but this is a theoretical question. whether this is possible at all, or the architecture of Oracle simply does not allow ...

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 6^th, 2009, 9:50pm

proc_2 wouldn't be 'exposed' (eg visible in user_arguments) so as far as anything outside the package goes, it simply doesn't exist.

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 6^th, 2009, 10:35pm

on 12/06/09 at 21:50:39, gamyers wrote:

proc_2 wouldn't be 'exposed' (eg visible in user_arguments) so as far as anything outside the package goes, it simply doesn't exist.

Then perhaps the only way to do this re-create the package and declare a func/proc ;D

Thanks Gamyers

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 7^th, 2009, 10:13am

This is an interesting question that i dont instantly know the answer without checking. The answer will come down to one of two things:

1) Does Oracle control execution of procedures within packages (i.e. resolve scope) at the database metadata level?

2) Does oracle control procedure execution within packages at the PL/SQL VM level and then within the VM level is it resolved at compile time (static semantic analysis?) or at run time (via dynamic semantic analysis?)

I would say its much more towards the VM/compiled code - has to be. BUT there is a possibility. As the compiled code is held in ther IDL$ tables it could possibly be modified or if its a case when the p-code is not held in the IDL$ tables then the DIANA could be modified in SOURCE$.

Its way too complex to consider even if its possible you need to be connected to the SYS schema with modification rights to make it work. A trojan approach would be better to modify the package header either in source code files or in the database and get it recompiled?

cheers

Pete

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 7^th, 2009, 10:14am

Sorry forgot to add, why?

Title: Re: procedure in package body and not declares
Post by Pete Finnigan on Dec 9^th, 2009, 1:08am

This is interesing if modify a code can add a not secure func. to secure package :) , "rootkit" for oracle i try to code one :)
If can to call a func which is not declared in package this is good metod to "trijan" a bd.
will think more...