Oracle CPU July 2007

The Oracle CPU July 2007 is out.

The CPU contains fixes for 46 Oracle vulnerabilities. Most of the vulnerabilities are coming from the usual suspects. Integrigy (8 of 14 EBusiness Suite vulns), Red-Database-Security (3 vulnerabilities), Argeniss, NGS, Joxean Koret. This time Imperva found also a vulnerability. Welcome to the usual suspects…
2 of Integrigy’s SQL Injection (Thanks to Steven Kost for the info) vulnerabilities are remote exploitable without authentication.

My vulnerabilities are a SQL Injection vulnerability in Apex (fixed with Apex 3.0.1), SQL Injection vulnerability in dbms_prvtaqis and a critical vulnerability in database views. The view bug is similar (but not identical) to bugs fixed with April 2006 and October 2006 . By using a specially crafted view it is possible to Insert/Update/Delete via database views.

More infos soon on the analysis webpage of Red-Database-Security.
The first advisories and an analysis of the Oracle CPU July 2007 are available on our website.
– Alex

Dieser Eintrag wurde am 17 Jul 2007 um 22:06 verfasst und befindet sich in Oracle Security. Sie können alle Antworten zu diesem Eintrag über den Feed RSS 2.0 mitverfolgen. Hinterlassen Sie eine Antwort oder einen Trackback-Link zu Ihrer eigenen Homepage.