Pete Finnigan's Oracle Security Weblog

I have just had an email from Alex Kornbrust who has let me know that his Metalink hacking paper has been released today. The paper is titled "Metalink Hacking" and is available on Alex's white papers page. The paper gives some background and details on Alex's investigations into using Google hacking techniques against the Oracle metalink repository. Alex starts by telling us about the 42 security bugs he found and then gives some general background information to how metalink is used and what it is. he then details some of his searches and the results he found in some cases including security bugs. Alex finishes with some guidelines on what is a security bug in Oracles eyes and goes on to look at some denial of service issues. Finally he gives some hints for customers and Oracle employees on using metalink more safely.

This is an excellent paper that covers some unusual ways of finding security bugs in Oracle.