Information Security News
mailing list archives
Re: 34 flaws found in Oracle database software
From: InfoSec News <isn () c4i org>
Date: Mon, 9 Aug 2004 07:43:28 -0500 (CDT)
Forwarded from: security curmudgeon <jericho () attrition org>
[Few comments on this article.. -jericho]
: By Jaikumar Vijayan
: AUGUST 03, 2004
: Oracle Corp. will soon issue patches to fix 34 different vulnerabilities
: in its database software that were disclosed to it early this year by a
: British bug hunter.
Thirty four is a lot.. perhaps Oracle could stand to hire some audit
: "They include buffer overflows, SQL injection issues and a whole range
: of other minor issues," said Litchfield, who discovered the flaws. He
: said that he reported them to Oracle in January and February.
Seven to eight month turnaround time... chalk that up to "regression
: Oracle confirmed the existence of the flaws, which were discussed
: publicly at last week's Black Hat security conference in Las Vegas, but
: did not offer any further comment. In an e-mailed statement, a company
: spokeswoman said that Oracle had fixed the flaws and would issue a
: security alert "soon."
All New 0-Day
David Litchfield, Founder, Next Generation Security Software
This presentation will be entirely new and never seen before. Code
Yet on the BlackHat CD provided, there is no bh-us-04-litchfield.pdf
set of slides (with or without 0-day). I also heard in passing that
Litchfield told the audience first thing that there would be no 0-day
disclosure, instead there would only be generic SQL injection
Can anyone confirm this? If true, did Jaikumar Vijayan not attend the
talk and write this based solely on the schedule?
Help InfoSec News with a donation: http://www.c4i.org/donation.html