Today someone has published an exploit for one of the bugs fixed in the CPU Oct 18 2005 security patch released by Oracle. The exploit was published to the Full Disclosure list by some remaining anonymous. The post is titled "[Full-disclosure] Exploit Oracle DB27 - CPU Octobre". It is not good that exploits are now in the public domain as anyone who has not patched is now vulnerable. all customers of Oracle should patch promptly.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Alex has posted an excellent analysis of the CPU Oct 18 database security bugs"] [Next entry: "Easy connect identifier"]
October 2005
- The Six Dumbest Ideas in Computer Security - 10/01/2005 by 10/01/2005
- Good thread on Oracle brute force password cracking and OUG Scotland - 10/03/2005 by 10/03/2005
- OUG Scotland - 10/05/2005 by 10/05/2005
- Link to David Litchfields original post - 10/06/2005 by 10/06/2005
- Slight correction to the HTMLDB advisories - 10/07/2005 by 10/07/2005
- Some more posts on bugtraq about David Litchfields open letter to Oracle - 10/08/2005 by 10/08/2005
- WebGoat an application to learn how to hack! - 10/10/2005 by 10/10/2005
- Security, SOX and Oracle Incentive Compensation - 10/11/2005 by 10/11/2005
- The Age talks about David Litchfields open letter to Oracle - 10/12/2005 by 10/12/2005
- Prevention and detection better than cure - 10/13/2005 by 10/13/2005
- How to encrypt/decrypt strings with the dbms_obfuscation_toolkit package - 10/14/2005 by 10/14/2005
- comments and how to re-enable them on this blog - 10/16/2005 by 10/16/2005
- CPU October 18th a few comments - 10/18/2005 by 10/18/2005
- Women who know Oracle and security - 10/19/2005 by 10/19/2005
- Easy connect identifier - 10/20/2005 by 10/20/2005
- Researcher: Oracle Patch Set Flawed Again - 10/21/2005 by 10/21/2005
- Exploit circulating for newly patched Oracle bug - It can crash an unpatched database server - 10/22/2005 by 10/22/2005
- Some fight back on Oracle security bugs - old news article - 10/26/2005 by 10/26/2005
- Josh has released a paper about the Oracle password algorithm - 10/27/2005 by 10/27/2005
- Some news stories about the josh oracle password paper - 10/29/2005 by 10/29/2005
- UKOUG tomorrow - 10/30/2005 by 10/30/2005
Archives
Syndication
Powered by gm-rss 2.0.0
