I just got an email from Alex to let me know he had received an email from Oracle about a security problem with the latest scheduled patch set CPU April 2005 for the database server for versions 9.2.0.5 and 9.2.0.6. This looks like a standard email to all Oracle customers. I have not received one yet but i guess that I will as I am also an Oracle customer.
The email states that the CPU April 2005 patch set for 9.2.0.5 and 9.2.0.6 for the database server has been reported that causes the fixes for alert #65 to be incomplete.
The email goes on to say that if customers have already applied the patch for alert #65 first then no action is required, if not alert #65 needs to be applied. It can be applied either before or after CPU April 2005 (Don't you wish for a better naming convention?). If alert #65 is already applied then there will be a conflict shown.
So why is this? - I guess it is because CPU April 2005 is supposed to be a cumulative patch for all previous fixes so it looks like CPU April 2005 did not include some of the alert #65 fixes.
If you have applied CPU April 2005 and not alert #65 then you will be vulnerable so take notice of these details.
Critical Patch Update - April 2005 has not been updated since April 13 so does not yet reflect this information. Also Alert 65, Security Vulnerability in Oracle9i Application and Database Servers has not been updated yet either.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Tim Gorman has updated his excellent fileprobe.sh script"] [Next entry: "Mark has a post about Oracle's talks to buy Siebel"]
April 2005
- New presentation on advanced SQL Injection - 04/01/2005 by 04/01/2005
- identity theft and database security - 04/02/2005 by 04/02/2005
- Alex Kornbrusts repscan tested and added to oracle security tools page - 04/03/2005 by 04/03/2005
- Pete's audit scripts updated - 04/04/2005 by 04/04/2005
- Amis Blog talks about writable external tables - 04/05/2005 by 04/05/2005
- SearchOracle has an excellent Oracle security links page - 04/06/2005 by 04/06/2005
- Alex Kornbrust has a new paper on google hacking and Oracle - 04/08/2005 by 04/08/2005
- An interesting post by Mark - 04/09/2005 by 04/09/2005
- O'Reilly CodeZoo - 04/11/2005 by 04/11/2005
- CPU April 12 - 2005 is released - 04/12/2005 by 04/12/2005
- InternetNews.com has a news item about CPU 2 - 04/13/2005 by 04/13/2005
- CPU 12 April researchers advisories - 04/14/2005 by 04/14/2005
- Another interesting Oracle-l thread on Oracle security auditing - 04/15/2005 by 04/15/2005
- Another news item about CPU 12 April - 04/16/2005 by 04/16/2005
- Interesting analysis of CPU 12 April - "To patch or not to patch" - 04/17/2005 by 04/17/2005
- Esteban Martínez Fayó releases his security advisories for CPU 12 April - 04/18/2005 by 04/18/2005
- Frank has a good review of a secure coding book - 04/19/2005 by 04/19/2005
- Tom Kyte has started a blog - 04/20/2005 by 04/20/2005
- Frank has a nice document recommendations - 04/22/2005 by 04/22/2005
- Some updated links on my Oracle security papers page - 04/23/2005 by 04/23/2005
- View privileges - 04/25/2005 by 04/25/2005
- A new paper on Oracle database passwords - 04/26/2005 by 04/26/2005
- Mark Coleman talks about Oracle and SOX compliance - 04/27/2005 by 04/27/2005
- Ed also talked about Tom and direct dictionary editing - 04/28/2005 by 04/28/2005
- Mark has a post about Oracle's talks to buy Siebel - 04/29/2005 by 04/29/2005
- Alex has added an Oracle exploits page to his site - 04/30/2005 by 04/30/2005
Archives
Syndication
Powered by gm-rss 2.0.0
