Oracle CPU April 2008 - Update
Dieser Eintrag stammt von Alexander Kornbrust Am 16 Apr 2008 @ 08:05 In Oracle Security | 2 Kommentare
Few hours ago Bruce Lowenthal sent me an email that Oracle forgot to inform me what was fixed. Hey how can you forget me. I am reporting bugs since several years… 
6 of my vulnerabilities are now history (if you apply the April patches or a new patchset like 10.2.0.4).3 of the vulnerabilities are the affecting Oracle Spatial. The packages [1] SDO_UTIL [DB05], [2] SDO_GEOM [DB06] and [3] SDO_IDX [DB07] are vulnerable against SQL Injection. SDO_IDX is also vulnerable in Oracle 11g.
1 vulnerability is a hardcoded [4] default password OUTLN [DB13] for the user OUTLN. In some special cases the Oracle database is resetting the password of the user OUTLN to OUTLN and grants DBA privileges to this user.
The CPU is also fixing 2 PL/SQL injection vulnerabilities from Paul Wright (see [5] Paul’s blog entry). At the moment there is no additional information about vulnerabilities available.
This CPU provides also fixes the the [6] Inline-View and [7] Create-View problem.
Dieser Artikel wurde ausgedruckt ab Alexander Kornbrust Oracle Security Blog: http://blog.red-database-security.com
URL zum Artikel: http://blog.red-database-security.com/2008/04/16/oracle-critical-patch-update-cpu-april-2008/
URLs in this post:
[1] SDO_UTIL [DB05]: http://www.red-database-security.com/advisory/oracle_sql_injection_sdo_util.html
[2] SDO_GEOM [DB06]: http://www.red-database-security.com/advisory/oracle_sql_injection_sdo_geom.html
[3] SDO_IDX [DB07]: http://www.red-database-security.com/advisory/oracle_sql_injection_sdo_idx.html
[4] default password OUTLN [DB13] : http://www.red-database-security.com/advisory/oracle_outln_password_change.html
[5] Paul’s blog entry: http://www.oracleforensics.com/wordpress/index.php/2008/04/15/april-2008-cpu/
[6] Inline-View: http://www.red-database-security.com/advisory/oracle_modify_data_via_inline_view
s.html
[7] Create-View: http://www.red-database-security.com/advisory/oracle_view_vulnerability.html
Klicken hier zum Drucken.