Red-Database-Security GmbH is specialized in Oracle Security

Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published Alerts
Upcoming Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap

Search

Details Oracle Critical Patch Update October 2005 - V1.07

After analyzing the new packages provided by patch 4579182 for Oracle 10.1.0.4 on Windows I could identify the following vulnerabilities and was able to match most of the database vulnerabilities with the DBxx numbers from Oracle. I can not guarantee that all my assumptions concerning the vulnerabilities are correct.

Up to now I was not able to identify the following Vuln# from Oracle: DB01 (sys.standard), DB04 (dbms_cdc_subscribe), DB10 (sys.utl_i18n) , DB13 (map methods), DB 14 (Intelligent Agent), DB16 (Oracle Network Services), DB26 (Programmatic interface), DB28 (sys.it), DB29 (sys.lt_ctx_pkg).

Oracle itself is using a different vulnerability naming convention. If a package (like MD2) with several procedures and functions contains several different vulnerabilities in different packages it is just 1 bug for Oracle.
On the 31-oct-2005 I reported 25 security issues with Oracle CPU October and Oracle 10g Rel. 2 to Oracle.

--- NEW --- NEW --- NEW --- NEW --- NEW --- NEW --- NEW

On the 7-nov-2005 Oracle Global Product Support sent a message to all customers using Oracle Enterprise Manager to download and re-apply Oracle CPU October again.

On the 8-nov-2005 David Litchfield posted a message on Buqtraq that the database patches for Oracle CPU October are buggy again. Few hours later Oracle Global Product Support sent an email to all customers what additional steps are necessary to perform, if you downloaded the patch before 9-nov-2005.

Extract of Oracle's email to their customers:

[...]
1) Go to the patch directory and execute the following steps. For e.g. if $ORACLE_HOME/Patch/4560405 is the patch directory, then: # cd $ORACLE_HOME/Patch/4560405
# $ORACLE_HOME/bin/sqlplus "/as sysdba"
SQL> shutdown
SQL> startup
SQL>ALTER SYSTEM ENABLE RESTRICTED SESSION;
SQL>@ctxcpu.sql
SQL>ALTER SYSTEM DISABLE RESTRICTED SESSION;

2) You can check for any invalid objects by executing following statement:
SQL> select OBJECT_NAME from DBA_OBJECTS where status = 'INVALID';

3) If you get any invalid objects returned from the above query, compile the invalid objects using the following commands:

# cd $ORACLE_HOME/rdbms/admin
# $ORACLE_HOME/bin/sqlplus "/as sysdba"
SQL> @utlrp.sql

Similarly, if you rollback the patch in the future, repeat the steps above to complete the de-installation after executing the Post-deinstallation steps as described in the Readme.html file.
Please accept our apologies for any inconvenience you may have experienced, and we thank you for your patience and cooperation in securing your Oracle server products.


[...]
--- NEW --- NEW --- NEW --- NEW --- NEW --- NEW --- NEW

References

• AppSecInc Inc - SHATTER Team Security Alert
• SPI DYNAMICS - Stack based overflow in Oracle 10g - emagent.exe
• LAC Corporation - Oracle Application Server HTTP Response Splitting Vulnerability
• Integrigy - E-Business-Suite Impact
• US-CERT - Technical Cyber Security Alert TA05-292A
• US-CERT - Vulnerability Notes Related to Critical Patch Update October 2005
• Oracle - Critical Patch Update October 2005
• Exploit from Full Disclosure - Database Crash
• Oracle October 2005 CPU Problems

• 9-nov-2005 - 1.07 - Problems with ctxsys & 8.1.7.4 and 9i Rel. 1 added
• 2-nov-2005 - 1.06 - History and References added

© 2005 by Red-Database-Security GmbH - last update 09-nov-2005

Oracle Patch Policy

Vulnerability Fixing Order of Oracke Vulnerabilities

• Main line of Code
• New Products (e.g. 10g Rel. 2)
• Patchsets for older products (e.g. 9.2.0.7)
• Critical Patch Update