Security | Oracle Critical Patch Update - January 2008

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required because of interdependencies by those security patches. Critical Patch Updates are cumulative, except as noted below, but each advisory describes only th...

Oracle Database 10 g - XML DB xdb.xdb_pitrig_pkg Package PITRIG_TRUNCATE Function Overflow

Oracle Database 10 g - XML DB xdb.xdbpitrigpkg Package PITRIGTRUNCATE Function Overflow source: https://www.securityfocus.com/bid/27229/info Oracle has released its critical patch update for January 2008. The advisory addresses 26 vulnerabilities affecting Oracle Database, Oracle Application...

Oracle Database 10 g - XML DB xdb.xdb_pitrig_pkg Package PITRIG_TRUNCATE Function Overflow

source: https://www.securityfocus.com/bid/27229/info Oracle has released its critical patch update for January 2008. The advisory addresses 26 vulnerabilities affecting Oracle Database, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business Suite, Oracle Enterprise Manager, and...

Oracle XDB component PITRIG_DROPMETADATA buffer overflow

Added: 11/23/2007 CVE: CVE-2007-4517 BID: 26374 OSVDB: 39918 Background The PITRIGDROPMETADATA function is included in the XDB.XDBPITRIGPKG package which is included with Oracle Database. Problem A buffer overflow vulnerability in the PITRIGDROPMETADATA function allows remote, authenticated...

Oracle XDB component PITRIG_DROPMETADATA buffer overflow

Added: 11/23/2007 CVE: CVE-2007-4517 BID: 26374 OSVDB: 39918 Background The PITRIGDROPMETADATA function is included in the XDB.XDBPITRIGPKG package which is included with Oracle Database. Problem A buffer overflow vulnerability in the PITRIGDROPMETADATA function allows remote, authenticated...

Oracle XDB component PITRIG_DROPMETADATA buffer overflow

Added: 11/23/2007 CVE: CVE-2007-4517 BID: 26374 OSVDB: 39918 Background The PITRIGDROPMETADATA function is included in the XDB.XDBPITRIGPKG package which is included with Oracle Database. Problem A buffer overflow vulnerability in the PITRIGDROPMETADATA function allows remote, authenticated...

Oracle XDB component PITRIG_DROPMETADATA buffer overflow

Added: 11/23/2007 CVE: CVE-2007-4517 BID: 26374 OSVDB: 39918 Background The PITRIGDROPMETADATA function is included in the XDB.XDBPITRIGPKG package which is included with Oracle Database. Problem A buffer overflow vulnerability in the PITRIGDROPMETADATA function allows remote, authenticated...

Oracle E-Business套件SQL注入漏洞

Oracle E-Business Suite是一款Oracle公司推出的电子商务套件。 Oracle E-Business Suite存在SQL注入问题，远程攻击者可以利用漏洞获得敏感信息或操作数据库。 问题存在于管理控制台中的okxLOV.jsp脚本，此页面允许攻击者指定参数给WHERE SQL命令而没有做任何过滤，导致以APPS用户权限执行任意SQL注入。 E-Business Suite 11 E-Business Suite 12 可参考如下安全公告获得补丁信息：...

Oracle Database Server MDSYS.SDO_CS缓冲区溢出漏洞

Oracle Database Server是一款商业性质的功能强大的数据库服务程序。 Oracle Database Server处理MDSYS.SDOCS.TRANSFORM函数存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 Oracle Database Server提供的MDSYS.SDOCS包包含子程序用于与协作系统工作。此包TRANSFORM过程处理存在缓冲区溢出，任何对MDSYS.SDOCS有执行权限的Oracle数据库用户可利用此漏洞。 Oracle Oracle9i Standard Edition 9.2 .6 Oracle Oracle9i...

Oracle Workspace Manager LT软件包SQL注入漏洞

BUGTRAQ ID: 26098 Oracle Database是一款商业性质大型数据库系统。 Oracle中捆绑的Workspace Manager包含有名为LT的软件包，LT软件包的实现上存在SQL注入漏洞，远程攻击者可能利用此漏洞获取非授权访问。 LT软件包属于SYS用户，可被PUBLIC执行，LT中的FINDRICSET过程调用了LTRIC软件包中的FINDRICSET ，而这个调用过程中存在SQL注入漏洞，允许远程攻击者通过提交恶意的SQL查询请求获得SYS权限。 Oracle Oracle9i Oracle Oracle10g Release 2 Oracle...

US-CERT Technical Cyber Security Alert TA07-290A -- Oracle Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-290A Oracle Updates for Multiple Vulnerabilities Original release date: October 17, 2007 Last revised: -- Source: US-CERT Systems Affected Oracle Database 10g Oracle 9i Database Oracle...

Oracle interMedia多个SQL注入漏洞

InterMedia是Oracle推出的对Oracle8i多媒体功能的扩充。 InterMedia不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 InterMedia包含的CTXDOC包存在多个SQL注入缺陷。如下的过程存在此漏洞： THEMES GIST TOKENS FILTER HIGHLIGHT MARKUP 数据库用户可通过这些漏洞不需要用户ID和密码访问Oracle应用程序服务器。 Oracle Oracle9i Application Server 9.2 .8 Oracle Oracle10g Standard...

Security | Oracle Critical Patch Update - October 2007

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required because of interdependencies by those security patches. Critical Patch Updates are cumulative, but each advisory describes only the security fixes added...

Oracle E-Business Suite - Multiple Vulnerabilities

Multiple security vulnerabilities have been corrected in the Oracle Business Suite 11i and R12 as part of July 2007 Oracle Critical Patch Update CPU. All Internet accessible environments should prioritize patch 6045931 APPS04/05/06 in order to correct multiple vulnerabilities in the On-line help ...

US-CERT Technical Cyber Security Alert TA07-200A -- Oracle Releases Patches for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-200A Oracle Releases Patches for Multiple Vulnerabilities Original release date: July 19, 2007 Last revised: -- Source: US-CERT Systems Affected Oracle Database Oracle Application Server...

Oracle Database Buffer overflow vulnerabilities in procedure DBMS_DRS.GET_PROPERTY (DB03)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Alert Update Oracle Database Buffer overflow vulnerabilities in procedure DBMSDRS.GETPROPERTY DB03 Jan 18, 2007 Updated July 18th, 2007 Risk Level: Medium Affected versions: Oracle Database Server versions 9i, 9iR2, 10gR1 and 10g...

Security | Oracle Critical Patch Update - July 2007

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required because of interdependencies by those security patches. Due to the threat posed by a successful attack, Oracle strongly recommends that fixes are applied...

Oracle Database - SQL Compiler Views Unauthorized Manipulation

Oracle Database - SQL Compiler Views Unauthorized Manipulation source: https://www.securityfocus.com/bid/24887/info Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected...

Oracle Database - SQL Compiler Views Unauthorized Manipulation

source: https://www.securityfocus.com/bid/24887/info Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well. The issues identified by the vendor...

Oracle Database Advanced Replication component DBMS_SNAP_INTERNAL overflow

Added: 04/25/2007 CVE: CVE-2007-2116 BID: 23532 OSVDB: 39933 Background Package DBMSSNAPINTERNAL of schema SYS is an Advanced Replication component used internally by Oracle Database. Problem A buffer overflow vulnerability in DBMSSNAPINTERNAL allows remote attackers to execute arbitrary commands...