Pete Finnigan's Oracle Security Weblog

The latest quarterly Critical Patch Update CPU October 18 is finally out. I have kept an eye on Oracles site during the day but it’s taken all day for it to arrive. It seems to get later into the evening (GMT) each time before it’s released for UK customers of Oracle anyway.

The patch advisory titled "Critical Patch Update - October 2005" has a slightly different format than the last ones. The start of the CPU breaks down the products into categories from I to III, the first I covers products that are protected by error correction support of extended maintenance support - this includes the database, application server, E-Business Suite and PeopleSoft and JD Edwards, II covers products bundled with category I products, category III products are de-supported as standalone but are bundled as part of some category I products. This bit I never understand. How can a product be supported and de-supported at the same time. The key point to make I suppose is that if you happen to be stuck with one of these then you might be able to take advantage of limited security bug fixes even though it says that these are only supported if bundled with category I products, or maybe Oracle is clarifying this fact in this CPU?

There are a few new names mentioned in the credits list, two guys from SpiDynamics and also Little eArth Corporation Co in Japan. The usual suspects of Alex, Esteban, Stephen and David are also listed.

The list of bugs includes many packages and function exploits. These could be overflows or SQL Injection, no details are given. The ALTER SESSION is shown as exploitable so this is likely a buffer overflow? There are also a number of internet facing bugs listed. The second list for the Application Server gives almost nothing away at all to allow any customer to guess what the issues that were exploitable were, the same applies with the collaboration suite matrix. E-Business Suite lists a lot of bugs and also there is one in the Enterprise Manager. There are 4 PeopleSoft bugs and 2 JD Edwards ones listed including one PeopleSoft workaround. A total of 84 bugs fixed.