ORA-06598: insufficient INHERIT PRIVILEGES privilege

Few days ago I observed, all of a sudden, one of the application related cron job started failing with following error.

ORA-06598: insufficient INHERIT PRIVILEGES privilege

This job was intended to drop temporary tables in application schema. We had written a shell script in which SYS user executes procedure owned by application schema.

Only thing that was changed at DB end, that DB was upgraded from 11g to 12c.

After investigating further on the error, I found this was due to a new 12c security feature.

Before Oracle Database 12c, a PL/SQL code/pacakge/procedure always ran with the privileges of its invoker. If its invoker had higher privileges than its owner, then the code might perform operations unintended by, or forbidden to, its owner. Here we can see security gap.

For example, User A creates a new package and we execute it from users with higher privileges, like SYS. Now user A knows that SYS uses this package regularly, so user A could replace the contents of this package with some malacious code any time and do anything in the database, knowing the code will be ran by SYS sooner or later.

In 12c this behavior can be controlled using INHERITANCE PRIVILEGES.

See following link for more details.


As of Oracle Database 12c, a PL/SQL code/pacakge/procedure can run with the privileges of its invoker only if its owner has either the INHERIT PRIVILEGES privilege on the invoker or the INHERIT ANY PRIVILEGES privilege.

I was able to resolve the issue after issuing below command:

SQL> grant inherit privileges on user sys to <application schema>;

Grant succeeded.

Hope so u will find this post very useful 🙂




How to Migrate characterset of 12c database using Database Migration Assistant for Unicode (DMU) Tool

This post will help you to convert characterset of database from WE8ISO8859P15 to AL32UTF8 in 12C. From 12c you will need to use DMU tool for characterset conversion instead of traditional method of CSSCAN & CSALTER. DMU is the Database Migration Assistant for Unicode . It converts the NLS_CHARACTERSET of an existing database to AL32UTF8 or UTF8.

DMU divides coversion into 4 steps:

1. Install DMU repository.
2. Scan the database.
3. Resolve the migration issues.
4. Convert the database.

Once DMU is started, you will need to create database connection as given below:

dmu1 dmu2

So as to make use of DMU, you need to create DBMS_DUMA_INTERNAL package under SYS schema. For creating mentioned package, you need to run following script.


If not you will get following error:


Then you can complete DMU repository creation:

dmu4 dmu5 dmu6 dmu7



Now your database is ready for SCAN:






Wait till scanning completes then right click the connection name and choose “Database Scan Report”

dmu16 dmu17 dmu18

Once you get results, you need to tackle invalid representations & Over column limit issues.

For invalid representations, you will need to right click a table and choose “Cleansing Editor”. The characters with issues will appear as small squares. You can edit data so as to fix invalid represenations.

For over column limit, you will need to use bulk cleansing option as shown below:

dmu22 dmu23 dmu23 dmu24 dmu25 dmu26 dmu27 dmu28

Now you will notice no migration issues observed after scanning database.


Now your database is ready for characterset migration🙂

dmu30 dmu31 dmu32 dmu33


Hope so u will find this post very useful 🙂