Call: +44 (0)1904 557620 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Another news item about CPU 12 April"] [Next entry: "Interesting analysis of CPU 12 April - "To patch or not to patch""]

Frank has a fix for Forms 10.1.2 for the SQL Injection issue



I posted here last week about the recent paper released by Alex Kornbrust talking about a default installation issue with Oracle forms and SQL Injection. I also mentioned the same issue in my post "CPU April 12 - 2005 is released". The problem is that in a default Forms installation there exists a little known pop up query window that allows the possibility of SQL Injection attacks.

Frank Nimphius has posted an entry to his blog titled http://www.orablogs.com/fnimphius/archives/001042.html - (broken link) Forms: Upcoming change in the default settings of Oracle Forms 10.1.2 to enforce secure Forms application deployment that talks about a fix for this issue in Oracle Forms 10.1.2. Frank says the fix is in response to my post about Alex's paper and because of Oracle's commitment to more secure default installations of its products.

Frank also gives a fix for current users and also talks about those users who do use the query window.

Take a good look at http://www.orablogs.com/fnimphius/archives/001042.html - (broken link) Franks post if you are a Forms user or implementer and use the advice given.