What is EXTPROC in Oracle?

oracle security database-security
Ace picture Ace · May 14, 2015 · Viewed 11.6k times · Source

For security reasons I asked DB team to add EXTPROC_DLLS:ONLY; but they said this:

"Please be informed that the KEY = EXTPROC1526 doesn’t refer to any external process at all. This is just a key used by any process needs to call Oraxxx via IPC protocol. The key can be any value and the same key value should be passed via the tnsnames.ora"

To me, it seems wrong. Could you please help me on this? What is the exact use of EXTPROC and what happens if we don't add EXTPROC_DLLS:ONLY?

Answer

Moudiz picture Moudiz · May 14, 2015

For any program to connect the oracle database you need Extproc agent.

PLS/SQL for example needs Extproc to work with oracle

You can find more information about the securit here
Ill past some of the link

Description
***********
The Oracle database server supports PL/SQL, a programming language. PL/SQ can execute external procedures via extproc. Over the past few years there has been a number of vulnerabilities in this area.

Extproc is intended only to accept requests from the Oracle database server but local users can still execute commands bypassing this restriction.

Details
*******
No authentication takes place when extproc is asked to load a library and execute a function. This allows local users to run commands as the Oracle user (Oracle on unix and system on Windows). If configured properly, under 10g, extproc runs as nobody on *nix systems so the risk posed here is minimal but still present.

and an example here

Related questions

How to find the privileges and roles granted to a user in Oracle?

I am using Linux, Oracle10g. I have created one user called test. and granted create session and select any dictionary permission to the same user. i also granted sysdba and sysoper roles to the same users. Now i want …

Read More
How do I turn off Oracle password expiration?

I'm using Oracle for development. The password for a bootstrap account that I always use to rebuild my database has expired. How do I turn off password expiration for this user (and all other users) permanently? I'm using Oracle 11g, …

Read More
What is the recommended way to encrypt in Oracle?

I need some help from Oracle/Security experts. I'm going to make functions for encryption/decryption in our Oracle DB. I intend to use dbms_crypto with AES256. I understand that I should store the key file in the O/…

Read More