This one has been done to death on the newsgroup, but just in case you haven't seen it, there is a security hole in 9i when using the new ANSI join syntax. Consider the following example:
create user demo identified by demo; grant create session To us1; connect demo/demo
Now at this point, the DEMO user should only be able to query those tables accessible to PUBLIC. For example,
SQL> select * from dba_users; select * from dba_users * ERROR at line 1: ORA-00942: table or view does not exist
But as soon as you add in the newly supported ANSI join syntax, privileges appear to be bypassed.
select a.* from dba_users a cross join dual (all rows appear)
Of more concern, is that (unrelated to this bug) some joins of course allow updates/deletes etc. So a carefully created join using the new syntax can be used to destroy all sorts of things. (A cross join to SYS.OBJ$ would be the obvious candidate to do maximum damage
This listed as bug 2121935 which is fxed in 9i.2 and also a patch (of the same number) is available for some platforms on 188.8.131.52