Microsoft released a patch for CVE-2010-0490. More than 1 year ago I reported this issue to Microsoft.
Finally they fixed the problem.
Bug History:
5-February-2009 – Bug reported to Microsoft Security Response Center
30-March-2010 – Patch for CVE-2010-0490 released
The latest version 3.0 of our database scanner Repscan is now available. This new version supports MS SQL Server and Oracle databases. Repscan comes with a large amount of new features and a complete new GUI (First database scanner with Office-2007 UI).
Here some of the new features of Repscan 3.0:
Here some (old) features of Repscan:
Here some statements of Repscan 3.0 users:
„Repscan Rocks“, „I must have this tool.“, „Very cool stuff“, „really like the clean interface… checks are great“, „…tend to be more Oracle security information hub than just scanner :-)“
Over the next few weeks I will show here more details of some Repscan 3.0 features.
If you want to test Repscan 3.0 you can download it from our exclusive distributor Sentrigo
Sumit Siddarth (Sid) has just published a really good whitepaper about „Hacking Oracle from the Web„.This is the most comprehensive published collection of different techniques for attacking Oracle from the web. Sid spent a lot of time composing the different techniques mentioned in various presentations and whitepapers.
Sid describes various techniques like data extraction (inband techniques like union or error messages, out-of-band techniques like heavy queries, blind, …), privilege escalation (sys.kupp$proc, dbms_repcat_rpc and dbms_export_extension) and OS code execution.
Well done Sid.
Today Eric Maurice from Oracle Global Product Security released an interesting article about „Ensuring Critical Patch Update Quality„. He explains the entire test process, timeline (e.g. 15 weeks before the CPU is released the fixes will be selected), ….