[Previous entry: "Another news item about CPU 12 April"] [Next entry: "Interesting analysis of CPU 12 April - "To patch or not to patch""]
Frank has a fix for Forms 10.1.2 for the SQL Injection issue
April 17th, 2005 by Pete
Post to del.icio.us
Post to Furl
I posted here last week about the recent paper released by Alex Kornbrust talking about a default installation issue with Oracle forms and SQL Injection. I also mentioned the same issue in my post "CPU April 12 - 2005 is released". The problem is that in a default Forms installation there exists a little known pop up query window that allows the possibility of SQL Injection attacks.
Frank Nimphius has posted an entry to his blog titled "Forms: Upcoming change in the default settings of Oracle Forms 10.1.2 to enforce secure Forms application deployment" that talks about a fix for this issue in Oracle Forms 10.1.2. Frank says the fix is in response to my post about Alex's paper and because of Oracle's commitment to more secure default installations of its products.
Frank also gives a fix for current users and also talks about those users who do use the query window.
Take a good look at Franks post if you are a Forms user or implementer and use the advice given.
