NGS, released 10 advisories to the bugtraq mailing list on 23 December 2004. These advisories give details of how to exploit the bugs found. Some give enough details for the reader to easily create exploits, some whilst giving details would be harder for a reader to create an exploit for. As the NGS links in the advisories do not work, I will list the links to the advisories on bugtraq here:
- Oracle wrapped procedure overflow (#NISR2122004J)
- Oracle multiple PL/SQL injection vulnerabilities (#NISR2122004H)
- Oracle TNS Listener DoS (#NISR2122004F)
- Oracle ISQLPlus file access vulnerability (#NISR2122004E)
- Oracle clear text passwords (#NISR2122004D)
- Oracle extproc local command execution (#NISR23122004C)
- Oracle extproc directory traversal (#NISR23122004B)
- Oracle extproc buffer overflow (#NISR23122004A)
- Oracle Character Conversion Bugs (#NISR2122004G)
- Oracle Trigger Abuse (#NISR2122004I)
It is obviously now very clear that anyone who has not applied the patches for alert #68 should do so without delay. Exploits for the details released will be written and circulated.
Apply the patch for alert 68.