[Previous entry: "Chris was also talking about Alex's 42 bugs found in Metalink"] [Next entry: "Steve has added an undocumented sample for fixed JDBC credentials"]
Alex has released his paper on metalink hacking
May 31st, 2005 by Pete
Post to del.icio.us
Post to Furl
I have just had an email from Alex Kornbrust who has let me know that his Metalink hacking paper has been released today. The paper is titled "Metalink Hacking" and is available on Alex's white papers page. The paper gives some background and details on Alex's investigations into using Google hacking techniques against the Oracle metalink repository. Alex starts by telling us about the 42 security bugs he found and then gives some general background information to how metalink is used and what it is. he then details some of his searches and the results he found in some cases including security bugs. Alex finishes with some guidelines on what is a security bug in Oracles eyes and goes on to look at some denial of service issues. Finally he gives some hints for customers and Oracle employees on using metalink more safely.
This is an excellent paper that covers some unusual ways of finding security bugs in Oracle.
