Pete Finnigan's Oracle Security Weblog

I saw today via Alex, Milw0rm and Bugtraq that Andrea "bunker" Purificato has released a new exploit in DBMS_AQ.ENQUEUE for 10gR1, version 10.1.0.3.0. The [0-day] Remote Oracle DBMS_AQ.ENQUEUE exploit (10g) is written in Perl and the example uses a payload of granting ALL PRIVILEGES and DBA to the supplied Oracle user account. I am a bit confused at the 0-day title as the post also includes a reference to the patch for the Jan CPU 2007 - CVE-2007-0268.