Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Analysis: Automated Code Scanners: False Sense of Security?"] [Next entry: "NGS have released an analysis for the April CPU 2007"]

Analysis of April 2007 CPU

Alex has added a page to his site analysing the April 2007 CPU. This page is titled "Details Oracle Critical Patch Update April 2007 - V1.05". This gives an overview of what has been fixed and also summaries information from a number of sources. As usual, access to a "before" patch PL/SQL source and "after" PL/SQL source with the information describing which packages are involved should enable location of the actual bug (of course only where the bug is PL/SQL based).

Alex has also released five advisories:

"Bypass Logon Trigger [DB05] (fixed in CPUApr2007)" - which talks about an issue whereby it is possible to bypass database logon triggers and if these are used to enfore security then that security is broken.

"SQL Injection in DBMS_UPGRADE_INTERNAL [DB07] (fixed in CPUApr2007)" - This package contains SQL injection bugs

"SQL Injection in DBMS_AQADM_SYS [DB04] (fixed in CPUApr2007)" - This package contains SQL injection bugs

"XSS in Oracle Secure Enterprise Search [SES01] (fixed in CPUApr2007)" - A cross site scripting bug in Oracle secure search. An exploit is included

"Shutdown unprotected TNS Listener via Oracle Discoverer Servlet [AS01] (fixed in CPUApr2007)" - It is possible to send TNS stop commands via the discoverer servlet