monline

SearchOracle.com has a podcast with Peter Finnigan on his recently published whitepaper discussing the weaknesses of the PL/SQL wrapper built into most currently used Oracle RDBMSes.

The podcast is available as an mp3 from SearchOracle's website. It's not about the inner workings of the wrapper (do not listen to the podcast if you're curious about that ... read the paper instead ), but Pete's opinion about the wrapper's security and Oracle security in general.

Actually it's nothing new that Oracle is full of bugs (just about any DBA -who has spent some time with supporting an Oracle DB- is well aware of it), but the difficulty of (or required work for) reverse engineering wrapped PL/SQL code is something that was not that apparent until now.

I've also spent two days of my life some years ago trying to break the wrapper, but I gave up after some initial successes. It seemed to be too much of a headache compared to the benefits of success. I didn't know about IDL or the ADA roots of PL/SQL at that time either. However I'm sure that most security-minded PL/SQL developers tried to figure out how this or that wrapped code might work. You can come up with a lot even if you cannot fully unwrap it. You can get all the variables, external calls, etc. from the wrapped code just by looking at it.

PS: I just looked it up - I played around with the wrapper in Jan 2004. How fast time passes by!