Problems with the Oracle Critical Patch Update for April 2005

Hey all, Whilst analyzing Oracle's Critical Patch Update for April 2005 I noticed some failures in it, that meant certain issues the patch was supposed to fix were actually left unfixed. One set of vulnerabilities "fixed" by the April CPU is a group of SQL injection bugs in DBMSSUBSCRIBE and...

CVE-2004-0637

Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible...

CVE-2004-0637

Oracle Database Server versions 8.1.7.4 through 9.2.0.4 are affected by a privilege-escalation vulnerability in the publicly accessible ctxsys.driload package. An authenticated user can invoke ctxsys.driload to execute arbitrary SQL statements with DBA privileges, enabling actions such as creatin...

[Full-Disclosure] SQL Injection via CTXSYS.DRILOAD in Oracle 8i/9i

http://www.red-database-security.com/advisory/advisory200409031.htm RDS200409031 - Red-Database-Security GmbH Research Advisory Name SQL Injection via CTXSYS.DRILOAD in Oracle 8i/9i Systems Affected Oracle 8i / Oracle9i all platforms Severity High Risk Category SQL Injection Vendor URL...

[Full-Disclosure] iDEFENSE Security Advisory 09.02.04b: Oracle Database Server ctxsys.driload Access Validation Vulnerability

Oracle Database Server ctxsys.driload Access Validation Vulnerability iDEFENSE Security Advisory 09.02.04b www.idefense.com/application/poi/display?id=136&type=vulnerabilities September 2, 2004 I. BACKGROUND Oracle Database Server is a family of database products that range from personal database...

CVE-2004-0637

Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible...