Esteban Martinez Fayo just emailed me to let me know that he has released advisories for the bugs he found in Oracle that were patched with the CPU 12 April patch set. His bugs were found for Application Security Inc. Esteban has found five bugs, these can be found on Application Security Inc's Oracle Security Alerts page. The bugs are Denial of Service in Oracle interMedia, http://www.appsecinc.com/resources/alerts/oracle/2005-02.html - (broken link) Multiple SQL Injection vulnerabilities in DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUBSCRIBE packages, Multiple SQL Injection vulnerabilities in DBMS_METADATA package, http://www.appsecinc.com/resources/alerts/oracle/2005-04.html - (broken link) SQL Injection in ALTER_MANUALLOG_CHANGE_SOURCE procedure and http://www.appsecinc.com/resources/alerts/oracle/2005-05.html - (broken link) SQL Injection in CREATE_SCN_CHANGE_SET procedure.
These advisories are worth reading as they give quite a lot more detail than Oracle's own advisory.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Making Oracle Forms more secure"] [Next entry: "More insights to CPU 12 April and public exploit code"]
April 2005
- New presentation on advanced SQL Injection - 04/01/2005 by 04/01/2005
- identity theft and database security - 04/02/2005 by 04/02/2005
- Alex Kornbrusts repscan tested and added to oracle security tools page - 04/03/2005 by 04/03/2005
- Pete's audit scripts updated - 04/04/2005 by 04/04/2005
- Amis Blog talks about writable external tables - 04/05/2005 by 04/05/2005
- SearchOracle has an excellent Oracle security links page - 04/06/2005 by 04/06/2005
- Alex Kornbrust has a new paper on google hacking and Oracle - 04/08/2005 by 04/08/2005
- An interesting post by Mark - 04/09/2005 by 04/09/2005
- O'Reilly CodeZoo - 04/11/2005 by 04/11/2005
- CPU April 12 - 2005 is released - 04/12/2005 by 04/12/2005
- InternetNews.com has a news item about CPU 2 - 04/13/2005 by 04/13/2005
- CPU 12 April researchers advisories - 04/14/2005 by 04/14/2005
- Another interesting Oracle-l thread on Oracle security auditing - 04/15/2005 by 04/15/2005
- Another news item about CPU 12 April - 04/16/2005 by 04/16/2005
- Interesting analysis of CPU 12 April - To patch or not to patch - 04/17/2005 by 04/17/2005
- Esteban Martinez Fayo releases his security advisories for CPU 12 April - 04/18/2005 by 04/18/2005
- Frank has a good review of a secure coding book - 04/19/2005 by 04/19/2005
- Tom Kyte has started a blog - 04/20/2005 by 04/20/2005
- Frank has a nice document recommendations - 04/22/2005 by 04/22/2005
- Some updated links on my Oracle security papers page - 04/23/2005 by 04/23/2005
- View privileges - 04/25/2005 by 04/25/2005
- A new paper on Oracle database passwords - 04/26/2005 by 04/26/2005
- Mark Coleman talks about Oracle and SOX compliance - 04/27/2005 by 04/27/2005
- Ed also talked about Tom and direct dictionary editing - 04/28/2005 by 04/28/2005
- Mark has a post about Oracle's talks to buy Siebel - 04/29/2005 by 04/29/2005
- Alex has added an Oracle exploits page to his site - 04/30/2005 by 04/30/2005
Archives
Syndication
Powered by gm-rss 2.0.0
