Oracle Java Serialization/Deserialization

Oracle plans to drop support for data serialization/deserialization from the main body of the Java language, according to Mark Reinhold, chief architect of the Java platform group at Oracle.

Serialization is the process of taking a data object and converting it into a stream of bytes (binary format), so it can be transported across a network or saved inside a database, only to be deserialized later and used in its original form.

The products affected by this type of attack are multiple, since JAVA is the basis of many solutions. Within the database there are several areas vulnerable to this type of attacks, the most significant services being REST type. They are defined as (from the Oracle documentation);

Oracle REST Data Services (ORDS) makes it easy to develop modern REST interfaces for relational data in the Oracle Database, Oracle Database 12c JSON Document Store, and Oracle NoSQL Database. A mid-tier Java application, ORDS maps HTTP (S) verbs (GET, POST, PUT, DELETE, etc.) to database transactions and returns any results formatted using JSON.

HTH – Antonio NAVARRO

 

 

 

Advertisements

Released 18c Client

Oracle has released the client 18. Yes, the database is already waiting. Although you can see it or have an eye on the cloud. At the moment it is avaliable for Windows and Linux platforms only;

To download the client you have to access the following link;

http://www.oracle.com/technetwork/database/enterprise-edition/downloads/index-092322.html

HTH – Antonio NAVARRO

How To Get ORACLE_HOME From SQL

In many occasions we need to know the ORACLE_HOME of a database. To get this value we usually go to the operating system and look at the environment variable ($ORACLE_HOME for unix environments,%ORACLE_HOME% in Windows environments or ORACLE_HOME logic in VMS environments). Now from the database we can get this value (if I’m not wrong from version 12c) with the following query;

SELECT SYS_CONTEXT (‘USERENV’,’ORACLE_HOME’) FROM DUAL;

HTH – Antonio NAVARRO

How To Get DDL From a Diskgroup

This week I had to rebuild several diskgroups asm for a new environment that I have mounted, the issue is that I did not find a “DBMS_METADATA” or a script on the internet that would serve me for what I wanted to do, on the other hand it is a simple thing and can that being something relatively easy nobody has published something similar.

Here I put the little script that I put in if it can help someone.

 

SET SERVEROUTPUT ON SIZE 100000
SET LINES 1000
SET PAGES 1000SET VER OFF 

DECLARE
IS_FIRST_TIME  BOOLEAN := TRUE;
LINEA VARCHAR2 (100);
BEGIN
DBMS_OUTPUT.PUT_LINE ('==========================================================');
/* Create command */
select 'CREATE DISKGROUP ' || '&1' INTO LINEA FROM DUAL;
DBMS_OUTPUT.PUT_LINE (LINEA);
/* Redundancy type */
select decode ( type, 'EXTERN','EXTERNAL', type)  || ' REDUNDANCY DISK' INTO LINEA from v$asm_diskgroup where name =upper ( '&&1' );
DBMS_OUTPUT.PUT_LINE (LINEA);
/* Disks associated to the DG */
FOR i IN  (
SELECT PATH  FROM V$ASM_DISK JOIN  V$ASM_DISKGROUP ADG USING (GROUP_NUMBER)
WHERE ADG.name =   upper ( '&&1' )
)  LOOP
/* Put comma if multirows are returned */
IF NOT IS_FIRST_TIME THEN
DBMS_OUTPUT.PUT (',');
END IF;
DBMS_OUTPUT.PUT_LINE (i.path);
IS_FIRST_TIME := FALSE;
END LOOP i;
/* Allocation unit */
SELECT 'ATTRIBUTE ''au_size''=''' || ALLOCATION_UNIT_SIZE/1048576 || 'M'','  INTO LINEA from v$asm_diskgroup where name =  upper ( '&&1' );
DBMS_OUTPUT.PUT_LINE (LINEA);
/* Compatible ASM */
SELECT  '''compatible.asm''=''' || VALUE  || ''',' INTO LINEA  FROM V$ASM_ATTRIBUTE A JOIN  V$ASM_DISKGROUP ADG USING (GROUP_NUMBER)  WHERE ADG.name =  upper ( '&&1' )
AND A.NAME = 'compatible.asm';
DBMS_OUTPUT.PUT_LINE (LINEA);
/* Compatible RDBMS */
SELECT  '''compatible.rdbms''=''' || VALUE  || ''';'  INTO LINEA  FROM V$ASM_ATTRIBUTE A JOIN  V$ASM_DISKGROUP ADG USING (GROUP_NUMBER)  WHERE ADG.name =  upper ( '&&1' )
AND A.NAME = 'compatible.rdbms';
DBMS_OUTPUT.PUT_LINE (LINEA);
END;
/

HTH – Antonio NAVARRO

How Does OUI Decide oraInventory Location?

Here I like talk about where oraInventory is located. The Oracle Inventory is where all the software, bundles, merges, oneoffs that are installed on that machine are registered. Actually there are several files and it is important to have them located and make periodic backup of them. The following code tells us where it is.


if ORACLE_BASE is SET then { $ORACLE_BASE/../oraInventory }
else if not OFA-Complaint {/home/oracle/oraInventory}
else { /u[01-09]/app/oraInventory }

OFA is Optimal Flexible Architecture

HTH – Antonio NAVARRO

 

 

SYSTEM STATE Levels

Many times need perform SYSTEM STATE command to recopile information on some problem or by applyed from Support. In this post I like show the levels Many times need perform SYSTEM STATE command to recopile information on some problem or by applyed from Support. In this post I like show the levels that you can use for this command. Please be carefull using it in Production enviroments, and pay attention on some of them because it can “freze” the database (or Cluster if you use the -g all option).

  • 2 dump (not including the lock element)
  • 10 dump11 dump + global cache of RAC
  • 256 short stack (function stack)
  • 258 256 + 2 -> short stack + dump (not including the lock element)
  • 266 256 + 10 -> short stack + dump267 256 + 11 -> short stack + dump + global cache of RAC

 

Example;

oradebug dump systemstate 258

HTH – Antonio NAVARRO

Installing and Using OSWatcher (Release 8.1.2)

For those who do not know this tool, tell you that it is basically a shell script that collects a series of unix commands about the time dimension.

OSWatcher only use the next operating systems commands to recopile information;
VMSTAT
IOSTAT
MPSTAT
IFCONFIG
NETSTAT
TOP
TRACEROUTE

 

To install the latest version you must download it from ML / MOS, you need a license, even the most basic one.

To start it (in an easy way, many options are avaliables);

./startOSWbb.sh

To stop it;

./stopOSWbb.sh

To see the data;

Normally these traces are used to send information to Oracle, but you can see the data graphically with the following command

java -jar $OSWATCHER_HOME/oswbba.jar -i $OSWATCHER_HOME/archive

 

HTH – Antonio NAVARRO