Pete Finnigan's Oracle Security Weblog

I posted here last week about the recent paper released by Alex Kornbrust talking about a default installation issue with Oracle forms and SQL Injection. I also mentioned the same issue in my post "CPU April 12 - 2005 is released". The problem is that in a default Forms installation there exists a little known pop up query window that allows the possibility of SQL Injection attacks.

Frank Nimphius has posted an entry to his blog titled http://www.orablogs.com/fnimphius/archives/001042.html - (broken link) Forms: Upcoming change in the default settings of Oracle Forms 10.1.2 to enforce secure Forms application deployment that talks about a fix for this issue in Oracle Forms 10.1.2. Frank says the fix is in response to my post about Alex's paper and because of Oracle's commitment to more secure default installations of its products.

Frank also gives a fix for current users and also talks about those users who do use the query window.

Take a good look at http://www.orablogs.com/fnimphius/archives/001042.html - (broken link) Franks post if you are a Forms user or implementer and use the advice given.