Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "comments and how to re-enable them on this blog"] [Next entry: "CPU October 18th a few comments"]

Security Critical Patch Update October 18 is out

The latest quarterly Critical Patch Update CPU October 18 is finally out. I have kept an eye on Oracles site during the day but itís taken all day for it to arrive. It seems to get later into the evening (GMT) each time before itís released for UK customers of Oracle anyway.

The patch advisory titled "Critical Patch Update - October 2005" has a slightly different format than the last ones. The start of the CPU breaks down the products into categories from I to III, the first I covers products that are protected by error correction support of extended maintenance support - this includes the database, application server, E-Business Suite and PeopleSoft and JD Edwards, II covers products bundled with category I products, category III products are de-supported as standalone but are bundled as part of some category I products. This bit I never understand. How can a product be supported and de-supported at the same time. The key point to make I suppose is that if you happen to be stuck with one of these then you might be able to take advantage of limited security bug fixes even though it says that these are only supported if bundled with category I products, or maybe Oracle is clarifying this fact in this CPU?

There are a few new names mentioned in the credits list, two guys from SpiDynamics and also Little eArth Corporation Co in Japan. The usual suspects of Alex, Esteban, Stephen and David are also listed.

The list of bugs includes many packages and function exploits. These could be overflows or SQL Injection, no details are given. The ALTER SESSION is shown as exploitable so this is likely a buffer overflow? There are also a number of internet facing bugs listed. The second list for the Application Server gives almost nothing away at all to allow any customer to guess what the issues that were exploitable were, the same applies with the collaboration suite matrix. E-Business Suite lists a lot of bugs and also there is one in the Enterprise Manager. There are 4 PeopleSoft bugs and 2 JD Edwards ones listed including one PeopleSoft workaround. A total of 84 bugs fixed.