The second issue is that the CTXSYS.DRILOAD package on Windows 32 and 64 but for 10.1.0.2 is still vulnerable to exploit. A hacker can gain DBA with this package. This bug is caused by the patch copying the fixed file to the wrong location. If the August 2004 or Jan 2005 patches have been applied then David suggests that the exploit will not work for this version.
Oracle should hold their heads in shame on this one. Surely after finishing a patch fix and before release Oracle would test a patched server to see if it is still vulnerable? Oracle's next quarterly scheduled patch is due on July 12 so let's hope there is some quick re-checking going on behind the scenes!