I saw today via Alex, Milw0rm and Bugtraq that Andrea "bunker" Purificato has released a new exploit in DBMS_AQ.ENQUEUE for 10gR1, version 10.1.0.3.0. The [0-day] Remote Oracle DBMS_AQ.ENQUEUE exploit (10g) is written in Perl and the example uses a payload of granting ALL PRIVILEGES and DBA to the supplied Oracle user account. I am a bit confused at the 0-day title as the post also includes a reference to the patch for the Jan CPU 2007 - CVE-2007-0268.
Bunker has released a 0-day Oracle exploit
There has been 2 Comments posted on this article
April 3rd, 2007 at 06:02 pm
Pete Finnigan says:
I guessed that was what you meant, thanks for the update.
April 2nd, 2007 at 09:48 pm
Pete Finnigan says:
Sorry for mistake. I meant "first public exploit" with word "0day"... 