I saw a good news article on EWeek yesterday and made a note of it. The article is by Lisa Vaas and is titled "Researcher: Oracle Patch Set Flawed Again". It talks about David Litchfield’s claims that after reviewing the CPU Oct 2005 patch set that some of the bugs he reported are still exploitable. It is not clear whether he means that the actual bugs are not fixed or that the same general issue is still exploitable elsewhere in the same packages. Or could it be a combination of both scenarios. Lisa says that David is still investigating.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "An example of using DBMS_CRYPTO"] [Next entry: "Exploit circulating for newly patched Oracle bug - It can crash an unpatched database server"]
October 2005
- The Six Dumbest Ideas in Computer Security - 10/01/2005 by 10/01/2005
- Good thread on Oracle brute force password cracking and OUG Scotland - 10/03/2005 by 10/03/2005
- OUG Scotland - 10/05/2005 by 10/05/2005
- Link to David Litchfields original post - 10/06/2005 by 10/06/2005
- Slight correction to the HTMLDB advisories - 10/07/2005 by 10/07/2005
- Some more posts on bugtraq about David Litchfields open letter to Oracle - 10/08/2005 by 10/08/2005
- WebGoat an application to learn how to hack! - 10/10/2005 by 10/10/2005
- Security, SOX and Oracle Incentive Compensation - 10/11/2005 by 10/11/2005
- The Age talks about David Litchfields open letter to Oracle - 10/12/2005 by 10/12/2005
- Prevention and detection better than cure - 10/13/2005 by 10/13/2005
- How to encrypt/decrypt strings with the dbms_obfuscation_toolkit package - 10/14/2005 by 10/14/2005
- comments and how to re-enable them on this blog - 10/16/2005 by 10/16/2005
- CPU October 18th a few comments - 10/18/2005 by 10/18/2005
- Women who know Oracle and security - 10/19/2005 by 10/19/2005
- Easy connect identifier - 10/20/2005 by 10/20/2005
- Researcher: Oracle Patch Set Flawed Again - 10/21/2005 by 10/21/2005
- Exploit circulating for newly patched Oracle bug - It can crash an unpatched database server - 10/22/2005 by 10/22/2005
- Some fight back on Oracle security bugs - old news article - 10/26/2005 by 10/26/2005
- Josh has released a paper about the Oracle password algorithm - 10/27/2005 by 10/27/2005
- Some news stories about the josh oracle password paper - 10/29/2005 by 10/29/2005
- UKOUG tomorrow - 10/30/2005 by 10/30/2005
Archives
Syndication
Powered by gm-rss 2.0.0
