Yesterday Oracle announced via the FAQ - Note 282108.1 created for the first monthly security patch release - Security Alert #68 that the Oracle clients are also vulnerable. Whether the client also needs to be patched has also been discussed a few times over the last few weeks on lists such as ORACLE-L and c.d.o.*.
Point 21 in the above FAQ discusses the question "is the Oracle client also vulnerable because of the issues fixed in alert 68". It states that some of the issues addressed are also applicable to middle tier installations and also to client only installations. Basically a successful hack of the client will not get you into the database or its server if its been patched with alert 68 but the client is exploitable. Oracle have reduced the severity of the patch to 2 for clients and 2 for application servers if the application server has been patched.
Refer to the pdf on Oracle's OTN site available above for alert #68 and also the FAQ available only on metalink for more details
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Creating read only users"] [Next entry: "find_all_privs.sql : A script to find all privileges allocated to a user or role"]
September 2004
- A new Oracle security based weblog - 09/20/2004 by 09/20/2004
- Are your system triggers firing? - 09/21/2004 by 09/21/2004
- Arup Nanda is interviewed about the Oracle security patch nightmare - 09/22/2004 by 09/22/2004
- The SANS S.C.O.R.E. Oracle security checklist has been updated - 09/23/2004 by 09/23/2004
- KK Mookhey writes about auditing Oracle security - 09/24/2004 by 09/24/2004
- eweek article: Oracle Users Take Aim at High Costs, Security Silence - 09/25/2004 by 09/25/2004
- Oracle Database 9i SQL Command Buffer Overflow Vulnerability - 09/26/2004 by 09/26/2004
- Creating read only users - 09/28/2004 by 09/28/2004
- Oracle announce that clients also need patching for alert #68 - 09/30/2004 by 09/30/2004
Archives
Syndication
Powered by gm-rss 2.0.0
