ACE Director Alum Daniel Morgan, founder of Morgan's Library, is scheduling
complimentary technical Workshops on Database Security for the first 30
Oracle Database customers located anywhere in North America, EMEA, LATAM, or
APAC that send an email to
asra_us@oracle.com. Request a Workshop for
your organization today.
Purpose
Undocumented
AUTHID
CURRENT_USER
Dependencies
DBMS_ASSERT
KUPC$_API_ACK
KUPC$_WORKER_GET_PWD
DBMS_DATAPUMP
KUPC$_DEVICE_IDENT
KUPC$_WORKER_LOG_ENTRY
DBMS_DATAPUMP_INT
KUPC$_DISK_FILE
KUPCC
DBMS_METADATA
KUPC$_ENCODED_PWD
KUPD$DATA
DBMS_METADATA_UTIL
KUPC$_EXIT
KUPD$DATA_INT
DBMS_PLUGTS
KUPC$_FILEINFO
KUPF$FILE_INT
DBMS_PRIV_CAPTURE
KUPC$_FILELIST
KUPM$MCP
DBMS_SYSTEM
KUPC$_FILE_LIST
KUPP$PROC
DBMS_SYS_ERROR
KUPC$_JOBINFO
KUPU$UTILITIES_INT
DBMS_UTILITY
KUPC$_MDFILEPIECE
KUPUTIL
KU$_DUMPFILE_INFO
KUPC$_MDFILEPIECELIST
KUPV$FT
KU$_DUMPFILE_ITEM
KUPC$_MDREPLOFFSETSLIST
KUPV$FT_INT
KU$_LOGENTRY
KUPC$_MESSAGE
KUPW$WORKER
KU$_LOGLINE
KUPC$_SEQUENTIAL_FILE
PLITBLM
KUPC$QUEUE
KUPC$_WORKERERROR
UTL_FILE
KUPC$QUEUE_INT
KUPC$_WORKER_FILE
UTL_RAW
KUPC$QUE_INT
KUPC$_WORKER_FILE_LIST
Documented
No
Exceptions
Error Code
Reason
ORA-39215
invalid call to routine, REQUEST_ENCPWD
First Available
Not known
Security Model
Owned by SYS with EXECUTE granted to PUBLIC but all functionality appears protected by an ACCESSIBLE BY clause
kupf$file.add_file(
filename IN VARCHAR2,
directory IN VARCHAR2,
filesize IN NUMBER,
reusefile IN NUMBER,
is_dba IN BOOLEAN,
read_only IN BOOLEAN,
filetype IN NUMBER);
kupf$file.check_access(
in_directory IN VARCHAR2,
in_filename IN VARCHAR2,
out_directory OUT VARCHAR2,
is_dba IN BOOLEAN,
read_only IN BOOLEAN,
in_filetype IN NUMBER,
in_trans_env IN BOOLEAN);
kupf$file.init_cb(
jobname IN VARCHAR2,
jobowner IN VARCHAR2,
headersize IN NUMBER,
wid IN NUMBER,
operation OUT NUMBER,
blocksize OUT NUMBER,
databufsize OUT NUMBER,
metabufsize OUT NUMBER,
poimpfile OUT NUMBER,
poimpmsttbl OUT NUMBER,
poexpmsttbl OUT NUMBER,
msttblobjnum OUT NUMBER,
traceident OUT VARCHAR2,
instname OUT VARCHAR2,
guid OUT RAW,
jflgs OUT NUMBER,
cmpalg OUT NUMBER,
jobversion OUT VARCHAR2,
dmpfilver OUT NUMBER);
BEGIN
IF kupf$file.is_dumpfile_set_consistent THEN
dbms_output.put_line('T');
ELSE
dbms_output.put_line('F');
END IF;
END;
/
IF kupf$file.is_dumpfile_set_consistent THEN
*
ERROR at line 2:
ORA-06550: line 2, column 16:
PLS-00904: insufficient privilege to access object IS_DUMPFILE_SET_CONSISTENT
ORA-06550: line 2, column 16:
PLS-00382: expression is of wrong type
ORA-06550: line 2, column 3:
PL/SQL: Statement ignored
kupf$file.log_messages(
msgtype IN NUMBER,
msgline1 IN VARCHAR2,
msgline2 IN VARCHAR2,
msgline3 IN VARCHAR2,
msgline4 IN VARCHAR2,
msgline5 IN VARCHAR2,
msgline6 IN VARCHAR2,
msgline7 IN VARCHAR2,
msgline8 IN VARCHAR2,
msgline9 IN VARCHAR2,
msgline10 IN VARCHAR2);
kupf$file.read_lob(
ctx IN BINARY_INTEGER,
mdfilepieces IN sys.kupc$_mdfilepiecelist,
blocksize IN BINARY_INTEGER,
charsetid IN BINARY_INTEGER,
mdencoding IN BINARY_INTEGER,
version IN BINARY_INTEGER,
dstlob IN CLOB,
srclob IN BLOB,
mdreploffsets IN OUT sys.kupc$_mdreploffsetslist,
datalosswarn OUT BOOLEAN,
datalossmore OUT BOOLEAN);
kupf$file.parse_filename(
filename IN VARCHAR2,
dirpath OUT VARCHAR2,
name OUT VARCHAR2,
extension OUT VARCHAR2,
version OUT VARCHAR2,
trans_env IN BOOLEAN);
The demo at right if allowed to do so raises an ORA-39215
The reason this demo is published is that the anonymous block demonstrates
a typical response of an attacker trying to see if they have found an
exposed vulnerability.
kupf$file.request_encpwd(
wid IN NUMBER,
encpwd OUT RAW,
encpwdlen OUT NUMBER);
DECLARE
r RAW(32767);
n NUMBER;
BEGIN
FOR i IN 1 .. 1024000 LOOP
BEGIN
kupf$file.request_encpwd(i, r, n);
dbms_output.put_line(i);
dbms_output.put_line(r);
dbms_output.put_line(n);
EXCEPTION
-- WHEN OTHERS THEN RAISE;
WHEN OTHERS THEN NULL;
END;
END LOOP;
END;
/
kupf$file.request_file(
wid IN NUMBER,
sid IN NUMBER,
inflags IN NUMBER,
minsize IN NUMBER,
blocksize OUT NUMBER,
outflags OUT NUMBER,
maxfilesize OUT NUMBER,
filename OUT VARCHAR2,
filenum IN OUT NUMBER,
filepos IN OUT NUMBER,
allocsize IN OUT NUMBER,
credential OUT VARCHAR2
kupf$file.upd_tdx_fileinfo_cb(
jobname IN VARCHAR2,
jobowner IN VARCHAR2,
procorder IN NUMBER,
extvalue IN NUMBER,
dmplen IN NUMBER,
dmporl IN NUMBER,
dmpalc IN NUMBER);
kupf$file.upd_tdx_stats_cb(
jobname IN VARCHAR2,
jobowner IN VARCHAR2,
procorder IN NUMBER,
extvalue IN NUMBER,
rowscomp IN NUMBER,
errorcnt IN NUMBER,
granulecnt IN NUMBER,
elapsedtime IN NUMBER);
kupf$file.verify_dumpfile_set(
device_ident_message IN sys.kupc$_device_ident,
is_dumpset_complete OUT BOOLEAN,
current_job_mode OUT NUMBER,
response_wait_count OUT NUMBER,
seq_file_message OUT sys.kupc$_sequential_file);