Pete Finnigan's Oracle Security Weblog

Alex has added a page to his site analysing the April 2007 CPU. This page is titled "Details Oracle Critical Patch Update April 2007 - V1.05". This gives an overview of what has been fixed and also summaries information from a number of sources. As usual, access to a "before" patch PL/SQL source and "after" PL/SQL source with the information describing which packages are involved should enable location of the actual bug (of course only where the bug is PL/SQL based).

Alex has also released five advisories:

"Bypass Logon Trigger [DB05] (fixed in CPUApr2007)" - which talks about an issue whereby it is possible to bypass database logon triggers and if these are used to enfore security then that security is broken.

"SQL Injection in DBMS_UPGRADE_INTERNAL [DB07] (fixed in CPUApr2007)" - This package contains SQL injection bugs

"SQL Injection in DBMS_AQADM_SYS [DB04] (fixed in CPUApr2007)" - This package contains SQL injection bugs

"XSS in Oracle Secure Enterprise Search [SES01] (fixed in CPUApr2007)" - A cross site scripting bug in Oracle secure search. An exploit is included

"Shutdown unprotected TNS Listener via Oracle Discoverer Servlet [AS01] (fixed in CPUApr2007)" - It is possible to send TNS stop commands via the discoverer servlet