Call: +44 (0)7759 277220 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

Home » Archives » October 2005 » Security Critical Patch Update October 18 is out

[Previous entry: "comments and how to re-enable them on this blog"] [Next entry: "CPU October 18th a few comments"]

Security Critical Patch Update October 18 is out

October 18th, 2005 by Pete


The latest quarterly Critical Patch Update CPU October 18 is finally out. I have kept an eye on Oracles site during the day but itís taken all day for it to arrive. It seems to get later into the evening (GMT) each time before itís released for UK customers of Oracle anyway.

The patch advisory titled "Critical Patch Update - October 2005" has a slightly different format than the last ones. The start of the CPU breaks down the products into categories from I to III, the first I covers products that are protected by error correction support of extended maintenance support - this includes the database, application server, E-Business Suite and PeopleSoft and JD Edwards, II covers products bundled with category I products, category III products are de-supported as standalone but are bundled as part of some category I products. This bit I never understand. How can a product be supported and de-supported at the same time. The key point to make I suppose is that if you happen to be stuck with one of these then you might be able to take advantage of limited security bug fixes even though it says that these are only supported if bundled with category I products, or maybe Oracle is clarifying this fact in this CPU?

There are a few new names mentioned in the credits list, two guys from SpiDynamics and also Little eArth Corporation Co in Japan. The usual suspects of Alex, Esteban, Stephen and David are also listed.

The list of bugs includes many packages and function exploits. These could be overflows or SQL Injection, no details are given. The ALTER SESSION is shown as exploitable so this is likely a buffer overflow? There are also a number of internet facing bugs listed. The second list for the Application Server gives almost nothing away at all to allow any customer to guess what the issues that were exploitable were, the same applies with the collaboration suite matrix. E-Business Suite lists a lot of bugs and also there is one in the Enterprise Manager. There are 4 PeopleSoft bugs and 2 JD Edwards ones listed including one PeopleSoft workaround. A total of 84 bugs fixed.

  • PFCLScan

    Simply connect PFCLScan to your Oracle database and it will automatically discover the security issues that could make your Oracle database vulnerable to attack and to the potential loss of your data.

  • PFCL Obfuscate PFCLObfuscate

    PFCLObfuscate is the only tool available that can automatically add license controls to your PL/SQL code. PFCLObfuscate protects your Intellectual Property invested in your PL/SQL database code.

  • PFCL Training PFCLTraining

    PFCLTraining is a set of expert training classes for you, aimed at teaching how to audit your own Oracle database, design audit trails, secure code in PL/SQL and secure and lock down your Oracle database.

  • PFCL Services PFCLServices

    Choose PFCLServices to add PeteFinnigan.com Ltd to your team for your Oracle Security needs. We are experts in performing detailed security audits, data security design work and policy creation