Sun has released an alert notification (Sun Alert ID 101782) dated 15 July 2005 and titled "Mulitple Security Vulnerabilities in Oracle Affect SunMC" - The synopsis states that unprivileged local or remote users can execute arbitary code on Solaris systems which have installed and enabled Sun Management Center (SunMC). The SunMC software runs typically as the user "smcorau" which is unprivileged but it uses the Oracle listener. Therefore it is affected by multiple listener vulnerabilities in Oracle Alert #68. This affects SunMC 3.5 on Solaris 8,9 and 10 that have not had Sun patch 118829-04 applied.
Sun recommends installing patch 118829-04 or later and also installing Oracle's latest Critical Patch Update.
Why release a note now about bugs in Alert #68? - This could be symptomatic of a bigger issue. How many companies use Oracle because another supplier uses it and its part of some other software? If the supplier assumes the person running it has patched or vice versa - then how many Oracle systems are out there not patched?
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "A Russian language news article about unfixed Oracle security bugs disclosure"] [Next entry: "Oracle dragging heels on unfixed flaws, researcher says"]
July 2005
- whilst on the subject of orablogs - version 2 is in the wings - 07/01/2005 by 07/01/2005
- A new sample installation session for Oracle Password Repository (OPR) version 1.1.8 - 07/02/2005 by 07/02/2005
- Frank talked about form-based authentication with struts - 07/04/2005 by 07/04/2005
- orablogs is back - 07/05/2005 by 07/05/2005
- 10g Release 2 allows deletion of datafiles - 07/06/2005 by 07/06/2005
- Oracle have issued a second email with another exploitable vulnerability in 10.1.0.2 in CPU 12APR - 07/07/2005 by 07/07/2005
- Paying a ransom to read your data - 07/08/2005 by 07/08/2005
- Two security bugs found and reported to Oracle in 10g Release 2 already! - 07/11/2005 by 07/11/2005
- Self signed SSL certificates with JInitiator - 07/12/2005 by 07/12/2005
- Oracle Simplifies SOA Security - 07/13/2005 by 07/13/2005
- Internet News talks about Oracles latest Critical Patch Update - 07/14/2005 by 07/14/2005
- A good German new item on CPU 12 July 2005 - 07/15/2005 by 07/15/2005
- More news on silent fixes in CPU July 2005 - 07/16/2005 by 07/16/2005
- Sun has released an alert notification (15 July 2005) about multiple security vulnerabilities in Oracle affecting SunMC - 07/19/2005 by 07/19/2005
- Oracle researcher announces high-risk database flaws - 07/20/2005 by 07/20/2005
- An Oracle spokeswoman speaks to TheAge - 07/21/2005 by 07/21/2005
- Oracle Confirms Holes in Two Latest Patch Sets - 07/22/2005 by 07/22/2005
- [Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package - 07/23/2005 by 07/23/2005
- New Oracle Security Forum opened - 07/25/2005 by 07/25/2005
- Mary Ann Davidson fights back - When security researchers become the problem - 07/27/2005 by 07/27/2005
- iDefense ups the bidding for bugs - 07/28/2005 by 07/28/2005
- VeriSign boosts security with iDefense acquisition - 07/29/2005 by 07/29/2005
Archives
Syndication
Powered by gm-rss 2.0.0
