Arriving San Francisco – OOW2008 day 1.

Written by Paweł Barut
My trip to San Francisco went well. No delays, no problems with flight reservation – see what happened to Tim. I had small problems with hotel reservation, but finally everything is fine – I’m in different hotel then I’ve reserved. I’m suffering little from jet-lag. I slept an hour or two in plane, and then I could not sleep during night. So I feel little tired. The weather in SF is great, especially when comparing to very cold and rainy weather in Krakow last week.

My first experience of San Fracinsco is not very good. Seems to be not very friendly, and is definitely not of my style. I might change my mind when see more places in SF. But Oracle Conference is organized very well, so my attitude is improving :).

For today, I’ve planned mostly session regarding Security and Identity management. First of those session “Oracle Security Risk” was very good. Especially speaker Tanya Baccam from SANS.org was impressive. Presentation was about common problems with security in web based and forms application that use Oracle DB as backend. One type of attack was new to me: CSRF – Cross Site Request Forgery.

Next one was Security Roundtable – lot of questions from audience on variety of topics. Most hot one: applying CPU patches, Auditing, DB Valut, Encrypting data and transmissions.

Then was Oracle Identity Management lead by Matt Topper. Good overview of identity products from Oracle stack.

My last one session “Storage: A New Paradigm for Database” was also very good session. Ari Kaplan show now storage solutions can improve Backup/Restore times for database and decrease demand for storage space. He also presented new RAID-DP concept, and claims that it can provide better performance, with lower storage demand, and provide higher availability. This is something that I need to investigate in more details.

For the evening I’m going to take part in Bloggers Meetup.

Cheers,
Paweł
--
Related Articles on Paweł Barut blog:

• Oracle OpenWorld 2008
• Preparing for Oracle OpenWorld 2008
• Arriving San Francisco – OOW2008 day 1.
• OOW2008 day 2 – Oracle Beehive
• OOW2008 day 3
• OOW2008 day 4 – HP-Oracle Exadata Server Announcement = Extreme Performance
• OOW2008 day 5 – It’s A Wrap

Oracle CPUApr2008 for DB: 10.2.0.4 patch set and first install

Written by Paweł Barut
To my surprise CPUApr2008 is not available for latest patch-set of Oracle 10gR2 (10.2.0.4) that was released in first quarter 2008. In note that goes together with patch 6810189:

The following are the updated components of this patch set:
  * Up to January 2008 CPU is included in this patch set
...

Based on this I was expecting that CPUApr2008 will be also available for 10.2.0.4 patch-set. In note 552248.1 you will find then:

1.3 Database 10.2.0.4 Patch Set

The Database 10.2.0.4 Patch Set includes the CPUApr2008 content.

So the CPUApt2008 was available to all at least month before official release and was included in 10.2.0.4 patch set! Is this situation secure?

Anyway I had to install CPUApr2008. It's good that there is no need to recompile views this time. I've sucessfully installed it on test server, with minor problem. In installation log I've found one problem:

BEGIN emd_maintenance.recompile_invalid_objects; END;

*
ERROR at line 1:
ORA-04068: existing state of packages has been discarded
ORA-04061: existing state of package body "SYSMAN.EMD_MAINTENANCE" has been
invalidated
ORA-06508: PL/SQL: could not find program unit being called:
"SYSMAN.EMD_MAINTENANCE"
ORA-06512: at line 1

Hmm... After reconnecting, this commend run without errors:

SQL> conn / as sysdba
Connected.
SQL> BEGIN sysman.emd_maintenance.recompile_invalid_objects; END;

PL/SQL procedure successfully completed.

After all, server runs ok, and I do not find any problems within applications running on this.


Cheers Paweł

--
Related Articles on Paweł Barut blog:

• CPUJan2008: One thing that every DBA should know about it.
• Security: getting DBA rights quite easy
• Comments in SQL*Plus
• Extracting Data to Excel using only SQL*Plus
• RMAN TIP: Avoiding ORA-27211

Horrible practice of storing users passwords

Written by Paweł Barut
I've read today terrifying article about un-ethical storage of users password. It is often common practice that users passwords are stored unencrypted in database. But this case is even more dreadful. It about software, G-Archiver, that is available to everyone. If you ever used this software, you should change your G-mail password right now.
So what is the problem:

• G-Archiver has build in user-name and password for one of g-mail accounts.
• Whenever someone uses G-Archiver and provides his credentials for g-mail, user-name and password is send to author of this software
• Additionally, any one who finds out the user-name and password stored in G-Archiver, can get passwords of thousand of previous users.

Go and read. Hope there are not too many of software that works like this one. It is really terrifying, that some people are so irresponsible. It could be well planed action to collect gmail users and passwords, or it could be just lack of imagination what are the consequences. I would like to believe that it was the second one.

But also big corporations do not care for security enough. It is common practice, that users password is stored internally as plain text. It can be easily found out by using "I forgot my password" feature. If in return you will get email with your original password, then it is a crappy web side. And you should never reuse password passed to such web side as this is big risk for you. Take a look at Password Security: It’s Not That Hard (But You Still Can’t Get It Right) for further explanation and examples.

Cheers Paweł

--
Related Articles on Paweł Barut blog:

• Security: getting DBA rights quite easy
• „Do not use Linux, please, pirate our software” - Microsoft
• Spam, Spam filters, Being Spammer, Being Filtered-out ...
• Do not trust Google Maps

CPUJan2008: One thing that every DBA should know about it.

Written by Paweł Barut
While reading documentation for latest Oracle security patch CPUJan2008 for database I've noticed one new required step. This step is: Recompile Views. One whould say that it's nothing strange, but to run this script database have to be started in UPGRADE MODE. For non-RAC installations it's not big issue, as anyway you have to plan downtime. But Oracle suggest that this recompilation can take 30 minutes:

"In one internal Oracle test with approximately 2000 views and 4000 objects, the total execution time for view_recompile_jan2008cpu.sql and utlrp.sql was about 30 minutes."

Practically in my case it took no more than 5 minutes, so it's not big deal.
But it could be problem for RAC installations, that used when CPU is applied on one node, then catcpu.sql is run, then second node is being patched. So normally DB will be all the time available. But if it's needed to start database in UPGRADE mode it means that downtime is required. According to documentation it's not required to run view recompilation script during paching process. This script can be run after,

"however, the CPU installation will not be complete until the view recompilation is completed."

You can ommit this step only if:

• Databases was created with Release 11.1.0.6 or later

• Databases was created with any release (for example, 10.2.0.3, 10.1.0.5, or 9.2.0.8) after CPUJan2008 or a later CPU has been applied

I hope it also means that after CPUJan2008 was applied you will not have to run this script after next CPU came out (CPUApr2008, etc).

Cheers Paweł

--
Related Articles on Paweł Barut blog:

• Security: getting DBA rights quite easy
• CPUApr2007 and Interim patch 3 for 10.2.0.3 on Windows
• Applying Oracle 10.2.0.3 patch
• Autobackup of SPFILE and CONTROLFILE
• Blogger Beta Backup tool

the Month of PHP Bugs

For all PHP developers, web admins and users this might be very interesting. the Month of PHP Bugs is an initiative to improve the security of PHP. It focuses on PHP Core vulnerabilities that are dangerous for web servers with applications written in PHP. It is done in hope that flaws that are publicly disclosed will get fixed quickly.

Cheers, Paweł

Security: getting DBA rights quite easy

I've stepped today at ORASEC blog by Paul Wright. I've found this issue a big problem. Anybody that is using Oracle client on windows can quite easy get DBA rights by editing client9.dll file. I've to check if this is still problem with latest Oracle 10.2.0.3 release.

Cheers, Paweł