Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Oracle have issued a second email with another exploitable vulnerability in in CPU 12APR"] [Next entry: "Is it possible to check whether Oracles CPU update emails are *real*?"]

David Litchfield has released an advisory for the recent CPU 12 April vulnerabilities

I got an email yesterday from Alex to let me know that he had seen the advisory post by David Litchfield to the Bugtraq mailing list. The post is titled "Problems with the Oracle Critical Patch Update for April 2005" and goes on to explain in more detail than Oracle's emails the issues that have been found. He starts by saying he analysed CPU 12 Apr and found that some bugs were not fixed that should have been. The first set of issues are SQL Injection bugs in DBMS_SUBSCRIBE and DBMS_ISUBSCRIBE. The issue is that the CPU Apr 12 patch fails to load the newly fixed Java classes.

The second issue is that the CTXSYS.DRILOAD package on Windows 32 and 64 but for is still vulnerable to exploit. A hacker can gain DBA with this package. This bug is caused by the patch copying the fixed file to the wrong location. If the August 2004 or Jan 2005 patches have been applied then David suggests that the exploit will not work for this version.

Oracle should hold their heads in shame on this one. Surely after finishing a patch fix and before release Oracle would test a patched server to see if it is still vulnerable? Oracle's next quarterly scheduled patch is due on July 12 so let's hope there is some quick re-checking going on behind the scenes!