Date: Tue, 16 Apr 2002 16:34:00 -0400
From: Charles J Wertz wertzcj@buffnet.net
To: Pete Finnigan pete@peterfinnigan.demon.co.uk, BUGTRAQ@securityfocus.com
Cc: wertzcj@buffnet.net
Subject: Re: ansi outer join syntax in Oracle allows access to any data
You don't need 9i or ansi syntax.
Connected to:
Oracle8i Enterprise Edition Release 8.1.6.0.0 - Production
With the Partitioning option
JServer Release 8.1.6.0.0 - Production
SQL> set serveroutput on size 1000000
SQL> sta users
SQL> select username, user_id, password from sys.dba_users
2 /
......................
USERNAME USER_ID PASSWORD
------------------------------ ---------- ------------------------------
GABRMJ21 206 A08F7F24DCD35845
ABDUSM62 204 25F6BFBE9888CB23
CLARVL18 205 E45523E8504F938E
SYMEJM94 195 BF1A81C928566EEE
COSAL75 118 4EDA8C950487B16F
CONNTS37 117 B3EB3D464F64E317
ANASD51 111 AC5DE6711420E91E
FEDEJB07 224 5111DAC3006F6D81
DELLJM28 223 FC707A68849F1C3F
CARTKR33 222 2002A82D0DB2DB19
BRANLD12 221 9857842415FF35B5
...
I haven't checked this out.
I take it these are encrypted passwords ??
cjw
