Call: +44 (0)1904 557620 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "A good German new item on CPU 12 July 2005"] [Next entry: "Red Database Security releases security advisories for high risk unfixed Oracle bugs"]

More news on silent fixes in CPU July 2005



I was searching technorati.com and found a http://www.captivereefing.com/virusblog/2005/07/15/aw-silently-fixed-security-bugs-in-oracle-critical-patch-update-july-2005/ - (broken link) blog entry about Alex's silent security bug fixes done in the latest Critical Patch Update. The post is a copy of a bugtraq entry titled "AW: Silently fixed security bugs in Oracle Critical Patch Update July 2005".

This post is Alex's original announcement in the Bugtraq mailing list and David Litchfield’s reply to him and the list and Alex's subsequent reply. Basically the DAV_PUBLIC bug was fixed in "Alert 52, Security Vulnerabilities in Oracle9i Application Server" (dated 2003) and this is what David was reporting to the list and Alex. So at least this bug was not fixed silently after all.

OK, so the DAV_PUBLIC bug was found by Mark and David Litchfield and fixed two years ago in a previous patch. So maybe I am missing the point but why is it mentioned again (at least in the patch readme files) for CPU July 2005 two years later?