[Full-disclosure] Oracle E-Business Suite Vulnerability Information April 2007



Integrigy has released additional information on the Oracle E-Business Suite
11i and R12 security vulnerabilities in the April 2007 Oracle Critical Patch
Update. This analysis includes details (type, impact, etc.) regarding the
vulnerabilities, a review of the required patches, and advice on applying
the 6-10 required patches in a timely manner.

http://www.integrigy.com/Oracle_CPU_April_2007.pdf

Based on our discussions with clients, there seems to be continuing
confusion regarding the versions (i.e., patch sets) required to apply the
security patches. Oracle's policy is simple - Oracle only supports the 2
most recent patch sets that have been released in the past 12 months for the
Oracle Database and Oracle Application Server. There are some exceptions to
policy based on operating system support and other product dependencies. To
highlight the differences between certified versions and versions supported
in the April 2007 CPU we have released the following -

http://www.integrigy.com/security-resources/analysis/Oracle-CPU-Support-Matr
ix-April-2007.pdf


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: MS02-018 Breaking ASP ODBC
    ... > after installing the latest security hotfixes as of April ... >>1) IIS 5 web server can't be contacted. ... >>before the patch and that fixed that problem. ... >>load some VB components that fail to connect to my Oracle ...
    (microsoft.public.inetserver.iis.security)
  • Re: question about oracle advisory
    ... assistance request) to ask that they make the patch available for 8i, ... database account and the create library privilege to exploit the bug, ... that showed whether you were vulnerable would be helpful to many Oracle ... > Oracle is not planning on releasing a patch for 8i releases. ...
    (Bugtraq)
  • Re: Oracle 8.1 on AIX 5.3
    ... On the question of whether to wait for the patch: ... I believe increasing those numbers are for bypassing the Oracle bug, ... There is a notorious bug in Oracle 8 - 9 that requires that the AIO request ... if you have 4 CPUs with 300 AIOs per CPU ...
    (AIX-L)
  • AW: DBD-Oracle 1.24b reports ORA-24334 in t/58object.t
    ... But now to the patch you made available for me. ... I could execute the perl Makefile.pl without significant problems. ... Unless you are going to use an oracle embeded type I would not worry about this error. ... WARNING: If you have trouble, ...
    (perl.dbi.users)
  • Re: question about oracle advisory
    ... fact I demonstrated exploit code for this vulnerability at the Blackhat ... Security Breifings in Amsterdam in the May of this year. ... do such demonstrations unless a patch is available for a problem. ... We initially informed Oracle about this issue ...
    (Bugtraq)