Pete Finnigan's Oracle Security Weblog

Today Oracle has sent out yet another email to customers who have previously downloaded the April 2005 CPU patches to let them know that there are yet more problems with it. The email starts by saying that if you have installed the later July CPU patch set then you do not have a problem. This email follows two previous emails from Oracle that concerned problems with the April CPU.

I wrote about this issue at the time - "Oracle have issued an email alert that CPU April 2005 is vulnerable to exploit" and "Oracle have issued a second email with another exploitable vulnerability in 10.1.0.2 in CPU 12APR" and also "David Litchfield has released an advisory for the recent CPU 12 April vulnerabilities" and finally "Is it possible to check whether Oracles CPU update emails are *real*?".

The email sent out today goes on to say that the recipients are getting the email because they received the email titled "Critical Patch Update April 2005 for Database 9.2 and 10.1 Update" sent out on July 6 or 7. That email said that a step was missing in the upgrade that caused a jar file to not be loaded to the database. That email gave instructions on how resolve the problems with the April Critical Patch Update.

This email now says that there were two problems with the last correction email. The first is that it said that database version 9.2.0.6 was affected. This is not now the case. Only versions 9.2.0.5 and 10.1.0.2, 10.1.0.3 and 10.1.0.4 are affected.

The email then goes on to say that the steps detailed in the previous correction email were themselves not correct. This current email now details the correct procedure and commands. The email also states that another work around is to apply CPU July as this includes the correct fix.