Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Nice list of Oracle's default ports"] [Next entry: "A select only user causing locks?"]

Very interesting undocumented feature on Amis

I saw a post on the Amis blog yesterday by Marco Gralike titled "Old undocumented stuff - Recompiling with timestamp". Of course the word undocumented grabbed my attention!

The post is quite a good one displaying the ALTER PROCEDURE {procedure name} COMPILE TIMESTAMP {time to use} in action. The TIMESTAMP clause is the key one here. Marco works through a simple example that shows the use of this statement to compile his sample procedure with a timestamp in the past. Someone posted in a comment that this functionality is needed for export and import to work. Marco has tested this on and says he has used it back in Oracle 7.0 / 7.1 days.

This is an interesting statement that you should be aware of if you monitor the database for changes made to the dictionary in particular changes to objects. If you use a method based on checking timestamps then you should be aware that these times cannot always be trusted. The same would apply if a hacker made direct changes to the timestamps in the base object SYS.OBJ$. The only method that is acceptable to monitor for changes to dictionary objects is to checksum them and to store the checksums outside of the database and use a baseline for subsequent checks to be made against.