---------------------------------------------------------------------- Accurate Vulnerability Scanning No more false positives, no more false negatives http://secunia.com/vulnerability_scanning/ ---------------------------------------------------------------------- TITLE: Oracle Database Multiple Vulnerabilities SECUNIA ADVISORY ID: SA38027 VERIFY ADVISORY: http://secunia.com/advisories/38027/ DESCRIPTION: Some vulnerabilities have been reported in Oracle Database, which can be exploited by malicious users to manipulate certain data, disclose potentially sensitive information, or compromise a vulnerable system and by malicious people to compromise a vulnerable system. 1) An error in the Listener component can be exploited to e.g. execute arbitrary code when running on the Windows platform. 2) An error in the Oracle OLAP component can be exploited by authenticated users to execute arbitrary code. 3) An error in the Application Express Application Builder component can be exploited by authenticated users to disclose or manipulate certain data. 4) An error in the Oracle Data Pump component can be exploited by authenticated users to disclose or manipulate certain data. 5) An error in the Oracle Spatial component can be exploited by authenticated users to disclose or manipulate certain data. 6) An error in the Logical Standby component can be exploited by authenticated users to manipulate certain data. 7) An error in the RDBMS component can be exploited by authenticated users to disclose or manipulate certain data. 8) An error in the Oracle Spatial component can be exploited by authenticated users to disclose or manipulate certain data. 9) An error in the Unzip component can be exploited by authenticated, local users to disclose certain data. The vulnerabilities are reported in the following products and versions: * Oracle Database 11g version 11.1.0.7 * Oracle Database 10g Release 2 versions 10.2.0.3 and 10.2.0.4 * Oracle Database 10g version 10.1.0.5 * Oracle Database 9i Release 2 versions 9.2.0.8 and 9.2.0.8DV SOLUTION: Apply patches (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: For the vulnerabilities fixed in the January Critical Patch Update, the vendor credits: * Esteban Martinez Fayo, Application Security, Inc. * Alexander Kornbrust, Red Database Security * David Litchfield, NGS Software * Brian Martin, INS.com * Guy Pilosof, Sentrigo * JPCERT/CC Vulnerability Handling Team * Daiki Fukumori [Secure Sky Technology], JPCERT/CC Vulnerability Handling Team * Dennis Yurichev ORIGINAL ADVISORY: Oracle: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2010.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------