After database upgrade to 12c Database on running script:
Script:
SQL> SET SERVEROUTPUT ON
BEGIN
xx_tools.osce_db_passwd_reset_pkg.change_db_account_passwords(p_execute_mode => TRUE);
END;SQL> 2 3
4 /
BEGIN
*
Error:
ERROR at line 1:
ORA-06598: insufficient INHERIT PRIVILEGES privilege
ORA-06512: at "XX_TOOLS.OSCE_DB_PASSWD_RESET_PKG", line 1
ORA-06512: at line 2
Cause
This is due to a new security feature in 12c:
Before Oracle Database 12c, an Invoker Rights (IR) unit always ran with the privileges of its invoker. If its invoker had higher privileges than its owner, then the IR unit might perform operations unintended by, or forbidden to, its owner. As of Oracle Database 12c, an IR unit can run with the privileges of its invoker only if its owner has either the INHERIT PRIVILEGES privilege on the invoker or the INHERIT ANY PRIVILEGES privilege.
Script:
SQL> SET SERVEROUTPUT ON
BEGIN
xx_tools.osce_db_passwd_reset_pkg.change_db_account_passwords(p_execute_mode => TRUE);
END;SQL> 2 3
4 /
BEGIN
*
Error:
ERROR at line 1:
ORA-06598: insufficient INHERIT PRIVILEGES privilege
ORA-06512: at "XX_TOOLS.OSCE_DB_PASSWD_RESET_PKG", line 1
ORA-06512: at line 2
Cause
This is due to a new security feature in 12c:
Before Oracle Database 12c, an Invoker Rights (IR) unit always ran with the privileges of its invoker. If its invoker had higher privileges than its owner, then the IR unit might perform operations unintended by, or forbidden to, its owner. As of Oracle Database 12c, an IR unit can run with the privileges of its invoker only if its owner has either the INHERIT PRIVILEGES privilege on the invoker or the INHERIT ANY PRIVILEGES privilege.
Solution:
SQL>
SQL> GRANT INHERIT PRIVILEGES ON USER "SYSTEM" TO PUBLIC;
Grant succeeded.
SQL> conn system/******
Connected.
SQL>
and then run the script , it went successfully.....
this is a new privilege in Oracle 12c .By default the privilege INHERIT PRIVILEGES is granted to PUBLIC, and it secures a weakness where a malicious user may accidentally get access to a privilege that user shouldn't have.
this is a new privilege in Oracle 12c .By default the privilege INHERIT PRIVILEGES is granted to PUBLIC, and it secures a weakness where a malicious user may accidentally get access to a privilege that user shouldn't have.
No comments:
Post a Comment