We have a user that has the DBA role. For various reasons in the short term we cannot revoke the DBA role (we are working on it long term). For now is there a way to revoke UTL_HTTP and a few other packages from the user, or because they have the DBA role are we out of luck?
utl_http is granted to "public" by default. you can revoke it from "public" and explicitly granted to each oracle user "per need".
also, you need to verify that the 'DBA' role will grant "utl_http" to the user. the easiest way to list the 'DBA' role permissions is using a GUI like TOAD or sql developer. it will list all privileges under 'DBA' role ( for example, create any table, create any view ,....etc)