I chatted to Alex earlier this evening and he let me know that he has added a new page to his site that analyses the October 2006 CPU. This page is titled "Details Oracle Critical Patch Update October 2006 - V1.00" and it details all of the database related bugs and APEX bugs fixed in the October CPU. In particular it details the bugs that Alex found with links to seperate advisory pages. These include:
xdb.dbms_xdbz0
sys.dbms_sqltune _internal
mdsys.sdo_lrs
SQL Injection in dbms_cdc_impdp2
Modifying data via in-line views
Oracle Reports Cross Site Scripting
Cross Site Scripting in APEX NOTIFICATION_MSG
Cross Site Scripting in APEX WWV_FLOW_ITEM_HELP
SQL Injection in APEX WWV_FLOW_UTILITIES
Enjoy!
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "October 2006 Critical Patch Update (CPU) is out"] [Next entry: "Oracle Issues Monster Security Patch"]
October 2006
- Oracle promises tighter security for SOAs - 10/01/2006 by 10/01/2006
- SQLGotcha version 3.0 is available - 10/03/2006 by 10/03/2006
- A portal exploit or security advice - 10/04/2006 by 10/04/2006
- Oracle 11i and SSO - 10/06/2006 by 10/06/2006
- Using JAZN LDAP for security in Portal - 10/07/2006 by 10/07/2006
- Data breaches near 94 million - 10/08/2006 by 10/08/2006
- Tom has discovered a PL/SQL oddity - 10/09/2006 by 10/09/2006
- Oracle will improve the CPU documentation with the Oct 17th 2006 CPU - 10/11/2006 by 10/11/2006
- Security bug in 10.2.0.2 not fixed yet - 10/13/2006 by 10/13/2006
- SANS Oracle S.C.O.R.E. document has been updated - 10/14/2006 by 10/14/2006
- Oracle to provide clearer vulnerability ratings - 10/16/2006 by 10/16/2006
- October 2006 Critical Patch Update (CPU) is out - 10/17/2006 by 10/17/2006
- Oracle plugs 101 security flaws - 10/18/2006 by 10/18/2006
- Oracle releases 101 patches in quarterly update - 10/20/2006 by 10/20/2006
- Users look for details on Oracle's next database - 10/23/2006 by 10/23/2006
- BT buys security outsourcer Counterpane - 10/26/2006 by 10/26/2006
- Best Practice for securing E-Business Suite updated - 10/27/2006 by 10/27/2006
- myspace hacked - 10/30/2006 by 10/30/2006
- Jonathan Lewis has a new weblog - 10/31/2006 by 10/31/2006
Archives
Syndication
Powered by gm-rss 2.0.0
