Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Internet News talks about Oracles latest Critical Patch Update"] [Next entry: "Oracle are asking customers to download CPU July 2005 for 10.1.0.x again as there is a problem"]

Oracle has been silently fixing security bugs in CPU July 2005

It looks like Oracle have been fixing security bugs in CPU July 2005 that are not included in the bugs listed in the risk matrix's that are in the - (broken link) advisory released on Wednesday. This fact has been discovered by Alex and I have been discussing this with him for a couple of days now. This is not a new phenomenon as other patch sets and point increases in version have also silently fixed security bugs.

Alex has issued a paper today titled "Oracle CPU July 2005 - Silently fixed bugs" that discusses this issue in relation to CPU July 2006.

What is the issue here? - are Oracle silently fixing security bugs reported to them or are these internally found security bugs? - maybe, the issue is that the bugs found are not reported as security bugs in the first place and they then go though the system remaining as non-security bugs? - but why then are there so many found by Alex this time in this CPU?