Pete Finnigan's Oracle Security Weblog

I got an email yesterday from Alex to let me know that he had seen the advisory post by David Litchfield to the Bugtraq mailing list. The post is titled "Problems with the Oracle Critical Patch Update for April 2005" and goes on to explain in more detail than Oracle's emails the issues that have been found. He starts by saying he analysed CPU 12 Apr and found that some bugs were not fixed that should have been. The first set of issues are SQL Injection bugs in DBMS_SUBSCRIBE and DBMS_ISUBSCRIBE. The issue is that the CPU Apr 12 patch fails to load the newly fixed Java classes.

The second issue is that the CTXSYS.DRILOAD package on Windows 32 and 64 but for 10.1.0.2 is still vulnerable to exploit. A hacker can gain DBA with this package. This bug is caused by the patch copying the fixed file to the wrong location. If the August 2004 or Jan 2005 patches have been applied then David suggests that the exploit will not work for this version.

Oracle should hold their heads in shame on this one. Surely after finishing a patch fix and before release Oracle would test a patched server to see if it is still vulnerable? Oracle's next quarterly scheduled patch is due on July 12 so let's hope there is some quick re-checking going on behind the scenes!