Auditing an Oracle database for security issues is very important. PeteFinnigan.com provides all of the information and tools that you will need Click here for details of PeteFinnigan.com Limited's detailed Oracle database security audit service Click here for details of PeteFinnigan.com Limited's Oracle Security Training Courses
There are 62 visitors online    
Cookie Policy:We only use essential cookies on small sections of this website. For details see here.

Pete Finnigan's Oracle security weblog


Home » Archives » October 2005 » Security Critical Patch Update October 18 is out

[Previous entry: "comments and how to re-enable them on this blog"] [Next entry: "CPU October 18th a few comments"]

Security Critical Patch Update October 18 is out

October 18th, 2005 by Pete


The latest quarterly Critical Patch Update CPU October 18 is finally out. I have kept an eye on Oracles site during the day but itís taken all day for it to arrive. It seems to get later into the evening (GMT) each time before itís released for UK customers of Oracle anyway.

The patch advisory titled "Critical Patch Update - October 2005" has a slightly different format than the last ones. The start of the CPU breaks down the products into categories from I to III, the first I covers products that are protected by error correction support of extended maintenance support - this includes the database, application server, E-Business Suite and PeopleSoft and JD Edwards, II covers products bundled with category I products, category III products are de-supported as standalone but are bundled as part of some category I products. This bit I never understand. How can a product be supported and de-supported at the same time. The key point to make I suppose is that if you happen to be stuck with one of these then you might be able to take advantage of limited security bug fixes even though it says that these are only supported if bundled with category I products, or maybe Oracle is clarifying this fact in this CPU?

There are a few new names mentioned in the credits list, two guys from SpiDynamics and also Little eArth Corporation Co in Japan. The usual suspects of Alex, Esteban, Stephen and David are also listed.

The list of bugs includes many packages and function exploits. These could be overflows or SQL Injection, no details are given. The ALTER SESSION is shown as exploitable so this is likely a buffer overflow? There are also a number of internet facing bugs listed. The second list for the Application Server gives almost nothing away at all to allow any customer to guess what the issues that were exploitable were, the same applies with the collaboration suite matrix. E-Business Suite lists a lot of bugs and also there is one in the Enterprise Manager. There are 4 PeopleSoft bugs and 2 JD Edwards ones listed including one PeopleSoft workaround. A total of 84 bugs fixed.

October 2005
SMTWTFS
      1
2345678
9101112131415
16171819202122
23242526272829
3031     

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

Weblog Home
Weblog Archives


Home
Oracle Security Tools page
Oracle security papers
Oracle Security alerts

Web Development
SQL Server Security

RSS 1.0 FEED
RSS 2.0 FEED
Atom 0.3 FEED
Powered by gm-rss 2.0.0


Valid XHTML 1.0!