Calendar
Januar 2008
M D M D F S S
« Dez   Feb »
 123456
78910111213
14151617181920
21222324252627
28293031  
Kategorien
Letzte Einträge
Links
Archive
Meta
« Oracle, white spaces and unexpected behaviour | First exploits for CPUJan2008 published »

Oracle Patch CPU January 2008 is out…

Oracle just released their latest Oracle Critical Patch Update (CPU) January 2008. As promised in the prelease announcement the patch contains 8 fixes for the database itself. As usual most of the vulnerabilities are coming from the usual suspects (Esteban, Joxean, David, Alex) and some other people like Pete Finnigan, Mariano Nunez Di Croce, Ali Kumcu and Alexandr Polyakov.

According to an email from Oracle secalert they fixed 7 of my vulnerabilities (tracking numbers: 6980733, 7520291, 9675443, 9675563, 9675681, 9675695, 9675857) but they mapped them to DB05, DB04 and DB02.

The highest database CVSS rating of 6.5 has DB01.
DB02, DB03, DB04 and DB05 are SQL Injection vulnerabilities allowing privilege escalation.

The highest application server CVSS ratings of 9.3 are 2 bugs (AS01, AS02) in Oracle Jinitiator 1.1.8.26 and 1.3.1.27 and affects clients only.

Other interesting information are described in the Metalink note 466757.1. With this CPU it is necessary to recompile ALL Views to fix the “VIEW” problems fixed with Oracle CPU July/October 2007.

Dieser Eintrag wurde am 15 Jan 2008 um 22:13 verfasst und befindet sich in CPUJan2008, Oracle Security. Sie können alle Antworten zu diesem Eintrag über den Feed RSS 2.0 mitverfolgen. Hinterlassen Sie eine Antwort oder einen Trackback-Link zu Ihrer eigenen Homepage.

1 Antwort auf “Oracle Patch CPU January 2008 is out…”

  1. Andre V.W. sagt:
    16 Jan 2008 bei 08:26

    Hi, the cursor used to find the views to recompile in the cpu script view_recompile_jan2008cpu.sql
    CURSOR alter1(objectno number) IS
    SELECT o.obj#,
    ‘ALTER VIEW’ || ‘ “‘ || u.name || ‘”.”‘ || o.name || ‘” ‘
    || ‘COMPILE ‘
    FROM obj$ o, user$ u WHERE o.type#=4 AND
    u.user# = o.owner# AND o.obj# in (select unique d_obj# from access$ where types=9)
    AND o.obj# > objectno order by obj#;
    .
    o.type#=4 points to VIEW types but I couldn’t find the meaning of access$.types=9 in sql.bsq. Alex, do you know what this 9 value means?

    Rgds,
    Andre

Antwort schreiben