Oracle releases, then pulls, zero-day database exploit code

Robert McMillan   Today’s Top Stories   or  Other Spam, Malware and Vulnerabilities Stories  

Client Security Podcast Google's Universal Search for Business Why SaaS is Vital to Email and Web Security Intercept Spam & Viruses The Impact of Messaging and Web Threats Spam Spikes: A Real Risk to Your Business SaaS Solutions for Remote Systems Management Learn-Fast Guide: Software as a Service is Growing Up Mobility @ the Speed of Business Sign up to receive Spam, Malware and Vulnerabilities Resource Alerts

April 10, 2006 (IDG News Service) -- Oracle Corp. appears to have accidentally released details about an unpatched security vulnerability in its database software, including sample code that could be used to exploit the problem. Details of the vulnerability were published last Thursday in a note that was briefly posted to Oracle's Metalink customer support portal.

The security community learned of the vulnerability early today when researcher Alexander Kornbrust posted an advisory on the situation to the Full Disclosure mailing list. Oracle removed the information on Friday, after being informed of the security risks associated with the Metalink note, said Kornbrust, a business director at Red-Database-Security GmbH, in Neunkirchen, Germany.

Oracle is planning to address the matter, the company said today. "Oracle is aware of information that was posted to Full Disclosure regarding a vulnerability in Oracle Database 9i and Oracle Database 10g. We plan to provide customers a patch that addresses this vulnerability in a future quarterly critical patch update," a company spokeswoman said.

The database vendor's next set of security patches is due on April 18.

In order to exploit the vulnerability, attackers would first need to have an account on the Oracle database, making this vulnerability unlikely to be exploited via the Web. However, by creating specially crafted queries, database users who would normally only be able to read data would be able to change the underlying data.

The vulnerability affects Oracle's database Versions 9.2.0.0 to 10.2.0.3 running on any operating system.

Kornbrust has published a number of work-arounds for the problem, which he does not believe will be patched in Oracle's April security updates. The work-arounds can be found on the Red-Database-Security site.

The security researcher said he decided to go public with the information on the vulnerability because enough people had already seen Oracle's Metalink note that it posed a risk for Oracle users.

It is ironic that the original source of this unpatched exploit, called a zero-day in hacker parlance, was Oracle itself, given Oracle's past criticism of researchers who disclose such vulnerabilities, Kornbrust said. "This time they can't blame security researchers," he said.

Oracle had no comment on how it came to release this sensitive information, but Kornbrust speculated that happened because of a mistake by the vendor's support organization.

"It looks to me like someone from Oracle support found information about this bug, and he was not aware that it was a security issue," he said. "I think the poor guy who published this information did this in context of helping people."

Reprinted with permission from

IDG.net
Story copyright 2008 International Data Group. All rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"Well, this malware attack approach is a new one to me. If you're like a lot of people, copying and..." Read more... "Angelina Jolie pregnancy was not a hoax; John McCain is not going to Vietnam as part of his presidential campaign;..." Read more... Read more Security posts or See all Blogs

Vista users rush for SP1, XP owners dawdle on SP3 iPhone 3G owner sues Apple over dropped calls, slow speeds Microsoft eases use of Photosynth Facebook hopes new ad scheme can engage users Microsoft to buy up to $100M in Novell SUSE Linux support vouchers Ericsson, STMicro to form mobile chip venture Wi-Fi in-flight comes to some American routes How to turn a software pirate into a paying customer Yahoo Buzz poses serious threat to Digg, some users say Emergency notification displays to bolster Virginia Tech alert systems More top stories...

WSJ: Microsoft hires Seinfeld to bite Apple China blocks iTunes, users claim Amazon launches persistent storage in the EC2 cloud Mozilla names best Firefox 3 add-ons Apple's MobileMe lacks key security feature Get tough on telecommuting: 6 questions to ask before you say yes Comcast: New traffic management plan still in the works Online encyclopedia lists internal network security threats Microsoft seeds WSUS with Windows 7 Client Palm plans to sell Treo Pro without U.S. operator partner

Forgotten PC history: The true origins of the personal computer The x86's lineage can be traced back to 1968, to a design on a napkin drawn by Austin O. "Gus" Roche, an all-but-forgotten engineer in Texas who was obsessed with creating a personal computer. Make Leopard leap: Time-saving tips for OS X 10.5 Are you using the latest version of Mac OS X efficiently? Try our tips and watch your productivity soar. Free Windows XP tuneup: Put new life into an old workhorse Just because Microsoft's done with XP doesn't mean you have to be. Keep XP in the game with these downloads, tweaks and hacks. Opinion: Why the iPhone is Apple's Trojan horse Apple's new iPhone software is more significant for IT than the new iPhone itself, says Michael Gartenberg. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland Security Apple's iPhone Ask a Premier 100 IT Leader Bill Gates steps down BlackBerry Legal Battle Data Security Breaches Electronic Voting Firefox H-1B Visas HP's Boardroom Scandal Handheld Devices Hurricane Katrina Aftermath Microsoft Legal Issues Microsoft's Vista Open Source RFID Technology SCO's Linux Fight Sarbanes-Oxley Act Spam Voice Over IP Wi-Fi Windows Meta File Vulnerability Windows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class 2006 Computerworld Horizon Awards 2006 Premier 100 IT Leaders 2006 Salary Survey 2007 Best Places to Work in IT 2007 IT Forecast 2007 Premier 100 IT Leaders 40 Years of Computerworld ASPs, Take Two Best Places to Work in IT 2003 Best Places to Work in IT 2004 Best Places to Work in IT 2005 Best Places to Work in IT 2006 Business Intelligence Home Runs Business Intelligence: Smarter BI Business Intelligence: The Future of BI CRM Goes Vertical CRM: Sober CRM Career Planning Guide 2005 Careers: IT Profession 2010 Computerworld Horizon Awards 2005 Data Management: Mining for Gems Data Management: Taming Data Chaos Development: Hard-Workin' Web Sites Development: New Tools New Choices Development: The New World of Application Development Development: The Web Services Tsunami Development: Web Services Hurdles Disaster Recovery: Preparing for the Worst E-commerce Grows Up E-mail/Groupware: Big Decisions Faces of Mobile IT Forecast 2006 Global Mobile Hardware: Multiple Cores, Multiple Challenges Hardware: On-Demand Un-Hyped Hardware: The Shape of Things to Come Horizon Awards: 10 Cool Cutting Edge Technologies IT Management: Guide to Managing Vendors IT Management: Navigating Global IT IT Management: Recovery Ahead IT Management: The Future of IT IT Management: The Resourceful Project Manager Innovative Technology Awards 2004 Management: Reinventing IT Microsoft in Transition Mobile/Wireless Leaders and Laggards Mobile/Wireless: The Untethered Worker Mobile/Wireless: Tiny Gadgets, Huge Costs Network Management: Taking Control Networking: Turbulence Ahead! Networking: VoIP Goes Mainstream Operating Systems: In the Slow Lane Operating Systems: Linux Goes Global Operating Systems: Should You Nix Unix? Outsourcing: Offshore Buyer's Guide Outsourcing: Outsourcing Dangers Premier 100 IT Leaders 2004 Best in Class Premier 100 IT Leaders 2005 Best in Class ROI: Do the Math! Salary Survey 2003 Salary Survey 2004 Salary Survey 2005 Security Action Plan Security: Compliance Headaches Security: Proactive Security Security: Risk and Reward Security: Tips From Security Pros Souped-up Security Storage: Battling Complexity Storage: Cheap & Secure Data Stores Storage: Stretching Your Storage Dollars Storage: The Lean Storage Machine Storage: The New Rules of Storage Storage: The Ultimate Backup Guide Supply Chain: Missing Links Supply Chain: RFID Reality Check The Business of Security Web 2.0 Security Wireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone The File Data Management Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Business Intelligence and Analytics Zone Windows Protection Zone Identity & Security Management Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this free webcast, for a limited time, compilments of Webroot Software! Go to the webcast  Managing Mobile Data with Endpoint Security for Laptops Download this white paper now, compliments of Computerworld and Absolute Software. (Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error.Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network. Download this executive briefing  Top 10 Reasons to Upgrade Get this white paper now! (Source: Symantec) Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Leading Analyst Firm: Penetration Testing is a Requirement Gartner Paper: US Data Centers - The Calm Before the Storm How Much Will an Office 2007 and Vista Migration Hurt? View more whitepapers

• Vista users rush for SP1, XP owners dawdle on SP3
• WSJ: Microsoft hires Seinfeld to bite Apple
• iPhone 3G owner sues Apple over dropped calls, slow speeds
• More top stories 

SQL Anywhere Developer Edition Download SQL Anywhere is the industry-leading mobile and embedded database. Designed for database-powered applications that operate in frontline environments without onsite IT support, SQL Anywhere offers enterprise-caliber features in a database that is easily embedded and widely deployed in server, desktop, remote office and mobile applications. Download the free SQL Anywhere Developer Edition