Today Alex let me know that Oracle released a note on the knowledge base on Metalink that details an unfixed security vulnerablity (0-day), including test cases (exploit code) that affects all versions of Oracle from 9.2.0.0 to 10.2.0.3. The note has now been removed but was in the headlines section and was titled "363848.1 ? A User with SELECT Object Privilege on Base Tables Can Delete Rows from a View". Alex has informed Oracle that it is not a good idea to release this sort of information on unfixed security bugs.
There is a detailed discussion of the issue on Alex's site in a page titled "Read-only user can modify data via views". This page details the issue and also includes exploit code (the actual method of exploit is censored out).
Dr. Christian Kleinew?chter and Swen Th?mmler from infinity3 GmbH found the issue.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Back blogging again about Oracle Security"] [Next entry: "Oracle Slip-up Results In Leaked Exploit Information"]
April 2006
- Oracle releases, then pulls, zero-day database exploit code - 04/10/2006 by 04/10/2006
- At the PSOUG Oracle day in Seattle - 04/14/2006 by 04/14/2006
- Happy birthday to Tom's blog - 04/17/2006 by 04/17/2006
- What is amazing is that a lot of CPU patches are not available until May!! - 04/18/2006 by 04/18/2006
- CERT Issues Alert for Oracle - 04/19/2006 by 04/19/2006
- Exploit code available for one of the bugs fixed in April 2006 CPU - 04/20/2006 by 04/20/2006
- My site is moving so could go down for a short while - 04/21/2006 by 04/21/2006
- My site is moving now - 04/28/2006 by 04/28/2006
- A quick update on my sites progress - 04/30/2006 by 04/30/2006
Archives
Syndication
Powered by gm-rss 2.0.0
