[ISN] 34 flaws found in Oracle database software

InfoSec News isn at c4i.org
Mon Aug 9 08:43:28 EDT 2004

Forwarded from: security curmudgeon <jericho at attrition.org>

[Few comments on this article..  -jericho]

: http://www.computerworld.com/securitytopics/security/story/0,10801,95013,00.html
: By Jaikumar Vijayan
: AUGUST 03, 2004
: Oracle Corp. will soon issue patches to fix 34 different vulnerabilities
: in its database software that were disclosed to it early this year by a
: British bug hunter.

Thirty four is a lot.. perhaps Oracle could stand to hire some audit

: "They include buffer overflows, SQL injection issues and a whole range
: of other minor issues," said Litchfield, who discovered the flaws. He
: said that he reported them to Oracle in January and February.

Seven to eight month turnaround time... chalk that up to "regression

: Oracle confirmed the existence of the flaws, which were discussed
: publicly at last week's Black Hat security conference in Las Vegas, but
: did not offer any further comment. In an e-mailed statement, a company
: spokeswoman said that Oracle had fixed the flaws and would issue a
: security alert "soon."


  All New 0-Day
  David Litchfield, Founder, Next Generation Security Software
  This presentation will be entirely new and never seen before. Code

Yet on the BlackHat CD provided, there is no bh-us-04-litchfield.pdf
set of slides (with or without 0-day). I also heard in passing that
Litchfield told the audience first thing that there would be no 0-day
disclosure, instead there would only be generic SQL injection

Can anyone confirm this? If true, did Jaikumar Vijayan not attend the
talk and write this based solely on the schedule?

More information about the ISN mailing list