The the only thing I can think of that meets all of these requirements is to do some type of service on the network that fetches data from oracle and sends back the data to the machines script. This should be relativity easy to do with SOAP::Lite client/server and some server side DBI/exported subs that return data structures after doing the update/selects. You can have the server side soap do whatever (sounds like very limited) auth from your requirements. The server side soap can be wide open or locked down to IP's etc via apache or your cgi.

Could you provide more detail into what you actually are trying to do here? This solution may be way off base depending on the actual need (besides the list of non-auth requirements above).