Alert - Serious Oracle Vulnerability Patch

Home
E-mail Us
Oracle Articles
New Oracle Articles

Oracle Training
Oracle Tips
Oracle Forum
Class Catalog

Remote DBA
Oracle Tuning
Emergency 911
RAC Support
Apps Support
Analysis
Design
Implementation
Oracle Support

SQL Tuning
Security
Oracle UNIX
Oracle Linux
Monitoring
Remote support
Remote plans
Remote services
Application Server
Applications
Oracle Forms
Oracle Portal
App Upgrades
SQL Server
Oracle Concepts
Software Support
Remote Support
Development
Implementation

Consulting Staff
Consulting Prices
Help Wanted!

Oracle Posters
Oracle Books
Oracle Scripts
Ion
Excel-DB

Don Burleson Blog

Alert -
Serious Oracle Vulnerability Patch

Oracle Tips by Burleson Consulting

June 9, 2004
John Garmany

Affected Applications are:

E-Business Suite 11i, 11.5.1 thru 11.5.8, All Platforms.

E-Business Suite 11.5.9 and later are not vulnerable.

Allows Unauthenticated Access to the Database.

This is an SQL Injection vulnerability.

SQL Injection is where an attacker inserts an SQL statement or fragment into an input field on a web page or form. The application then sends the SQL text to the database where it is executed with the Oracle process privileges.

This could allow an attacker to compromise, invalidate or allow unauthorized transmission of the data in the database.

Because this attack uses a browser and takes place at the application interface (internet or infranet) most intrusion detection and/or firewalls can not provide protection.

Oracle has a patch available on MOSC.

Details on the Patch are documented in the MOSC Document ID 274375.1

Get the Complete
Oracle SQL Tuning Information

The landmark book "Advanced Oracle SQL Tuning The Definitive Reference" is filled with valuable information on Oracle SQL Tuning. This book includes scripts and tools to hypercharge Oracle 11g performance and you can buy it for 30% off directly from the publisher.

��

June 9, 2004 John Garmany

June 9, 2004
John Garmany