Someone called N1V1Hd $3c41r3 has posted exploit code for the bug in the package function SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA to the bugtraq mailing list. The post is titled "Oracle 10g 10.2.0.2.0 DBA exploit" and it details how a package function can be created and then injected into DBMS_EXPORT_EXTENSION to grant DBA to a user called hacker.
Alex also has a page titled "SQL Injection via Oracle DBMS_EXPORT_EXTENSION in Oracle 9i / 10g" detailing the same exploit.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Security expert calls for Oracle makeover"] [Next entry: "My site is moving so could go down for a short while"]
April 2006
- Oracle releases, then pulls, zero-day database exploit code - 04/10/2006 by 04/10/2006
- At the PSOUG Oracle day in Seattle - 04/14/2006 by 04/14/2006
- Happy birthday to Tom's blog - 04/17/2006 by 04/17/2006
- What is amazing is that a lot of CPU patches are not available until May!! - 04/18/2006 by 04/18/2006
- CERT Issues Alert for Oracle - 04/19/2006 by 04/19/2006
- Exploit code available for one of the bugs fixed in April 2006 CPU - 04/20/2006 by 04/20/2006
- My site is moving so could go down for a short while - 04/21/2006 by 04/21/2006
- My site is moving now - 04/28/2006 by 04/28/2006
- A quick update on my sites progress - 04/30/2006 by 04/30/2006
Archives
Syndication
Powered by gm-rss 2.0.0
