[Previous entry: "A good German new item on CPU 12 July 2005"] [Next entry: "Red Database Security releases security advisories for high risk unfixed Oracle bugs"]
More news on silent fixes in CPU July 2005
July 16th, 2005 by Pete
Post to del.icio.us
Post to Furl
I was searching technorati.com and found a blog entry about Alex's silent security bug fixes done in the latest Critical Patch Update. The post is a copy of a bugtraq entry titled "AW: Silently fixed security bugs in Oracle Critical Patch Update July 2005".
This post is Alex's original announcement in the Bugtraq mailing list and David Litchfield’s reply to him and the list and Alex's subsequent reply. Basically the DAV_PUBLIC bug was fixed in "Alert 52, Security Vulnerabilities in Oracle9i Application Server" (dated 2003) and this is what David was reporting to the list and Alex. So at least this bug was not fixed silently after all.
OK, so the DAV_PUBLIC bug was found by Mark and David Litchfield and fixed two years ago in a previous patch. So maybe I am missing the point but why is it mentioned again (at least in the patch readme files) for CPU July 2005 two years later?
