Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


April 10, 2006

Oracle Slip-up Results In Leaked Exploit Information

A Web Exclusive from WinInfo
Mark Joseph Edwards
WinInfo
InstantDoc #49932
WinInfo
Email this Article
Printer Friendly
Reader Comments
Digg This
Del.icio.us
RSS
Subscribe to Windows IT Pro | See More Database Articles Here | Reprints | Or get the Monthly Online Pass—only $5.95 a month!
Vendors typically frown upon the premature publication of vulnerability and exploit information and usually its the discoverer who is the source of the leak. But last week Oracle was the source of a leak about a vulnerability, including a working exploit, in its popular Oracle Database server product.

In a message posted to the Full Disclosure mailing list, Alexander Kornburst, CEO and Business Director at Red Database Security, said that Jens Flasche informed him that on April 6 Oracle posted "details about an unfixed vulnerability and working test case" on its Metalink portal. The portal is used to provide customers with immediate access to technical support and product information.

Kornbrust said the "working test case" equates to a usable exploit that affects all versions of Oracle Database from 9.2.0.0 to 10.2.0.3. The vulnerability is that a user with "SELECT Object Privilege" on base tables can delete rows from a view, and according to Kornbrust it might be possible to also insert and update data or escalate privileges. Oracle is working on a patch for the problem.

"After noticing the [information online at Metalink] I informed [Oracle's security staff] that releasing such information on Metalink is not a wise idea. Oracle normally criticizes individuals and/or companies for releasing information about Oracle vulnerabilities [...] In this case, not only [did Oracle release] detailed information on the vulnerability they also included the working exploit code on [the Metalink site]."

Kornbrust said the information was removed soon after he contacted Oracle about posting the information on Metalink. Kornbrust added that since the information was made available on Metalink that he considers the vulnerability to now be public knowledge. He subsequently decided to post information about the vulnerability so that administrators could try to mitigate the risks while waiting on a patch for Oracle. Workaround information is available at the Red Database Security Web site. The company specializes in security services and solutions for Oracle Database.

End of Article

Reader Comments

You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now




Top Viewed ArticlesView all articles
What You Need to Know About Microsoft's x64 Server Product Plans

What do Longhorn Server, Windows Compute Cluster Server, and Windows Vista have in common? The x64 platform. ...

Anti-Virus Vendors Prepare for War with Microsoft ... Again

When Microsoft announced its Windows Live OneCare security and PC health product over five years (as MSN OneCare), Symantec, McAfee, and the other consumer-oriented security vendors reacted with stunning vigor. ...

Command Prompt Tricks

One reader shares his tip for setting up the command prompt to reflect a remote path. ...
Security Whitepapers Sustainable Compliance: How to reconnect compliance, security and business goals

The Impact of Messaging and Web Threats

Why SaaS is the Right Solution for Log Management
Related Events Security Summit

Oracle Fusion Middleware 11g Online Launch

Oracle Developer Day Online - EUROPE

Check out our list of Free Email Newsletters!
Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys
Related Security Resources Introducing Left-Brain.com, the online IT bookstore
Looking for books, CDs, toolkits, eBooks? Prime your mind at Left-Brain.com

Discover Windows IT Pro eLearning Series!
Clear & detailed technical information and helpful how-to's, all in our trademark no-nonsense format

Test Drive IT Solutions and Get Free Music Downloads
Solve your toughest IT problems with these free downloads and receive 5 free music downloads!


ADS BY GOOGLE

Job Openings in IT SPONSORED LINKS FEATURED LINKS
Get Microsoft Microsoft Certified With Train Signal Computer Training
Train Signal’s computer training software videos will teach you the skills you need to get certified and gain experience in areas like Windows Server 2008, Exchange Server, SharePoint Server, and more.
Get Mark Minasi’s Windows Server 2008 Audio CDs
"Windows expert, consultant and best-selling author Mark Minasi shows you if 2008 is right for you and, if so, how to get the most out of it!

Desktop Management is a Never-Ending Job for Administrators
Get a complete desktop management solution to centralize the management of thousands of desktops that will help you keep up with increased demand with limited manpower.

Integrate Fax Servers into Your Unified Communications Plan
In this fundamentals eBook you will learn how you can implement a solution that is easy to support, secure, and integrate.

Take Control of Your Email
Optimize your email storage – Download this white paper to learn key how-to’s in email storage management.

Get Windows IT Pro To Go!
The Windows IT Pro Magazine Master CD is a powerful combination of content and convenience.   Order now, and save up to 25%--plus you’ll get online access to new articles each and every month!  Subscribe today!
Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound ITTV
IT Library Technology Resource Directory Connected Home asp.netPRO Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement | Reprints and Licensing