Revoke object privileges from PUBLIC
ChewyApr 14 2012 — edited Apr 14 2012Hi Guys,
Database: 10.2.0.5
Recently we have an audit carried on one of our production DB:
We are advised by the auditor to:
1. revoke execute from public for the below packages/function:
UTL_SMTP
UTL_TCP
UTL_HTTP
UTL_FILE
DBMS_RANDOM
2. revoke table access privileges (select,update,delete) from public:
The owner of the tables where privileges granted to public are basically the below which i believe are granted by default during creation of db:
CTXSYS
DMSYS
EXFSYS
MDSYS
OLAPSYS
ORDPLUGINS
ORDSYS
SYS
SYSTEM
WMSYS
XDB
I understand the risk of granting to public, it means every database ID in the database can use the access granted to public.
Since it's granted default by oracle, should we actually remove it? I'm afraid that if i remove it, it will cause some complications.
Since it's identified as security findings, Why doesn't oracle grant only to users that require it instead it of public as default?
Kindly avdvise.
thanks!