Oracle e-biz suite needs patching
Print storyGet to it, sharpish
Posted in Enterprise Security, 11th June 2004 15:38 GMT
Free whitepaper – Vulnerability management buyer's checklist
Users of Oracle e-business suite applications must patch systems following the discovery of multiple vulnerabilities. Unpatched Oracle E-Business Suite 11i and Oracle Applications 11.0 packages are subject to Multiple SQL injection flaws that could be used to manipulate database entries, Oracle warns.
In the hands of knowledgeable crackers, these vulnerabilities could be remotely exploited simply by using a browser and sending a specially-crafted URL to the web server. Oracle E-Business Suite 11i, 11.5.1 up to 11.5.8 are affected. Users of 11.5.9 and above are safe. All versions of Oracle Applications 11.0 are vulnerable.
There's no interim workaround, so users are strongly advised to apply Oracle's patch. The "critical" flaws were discovered by researchers at security tools firm Integrigy, which specialises in developing intrusion prevention software for Oracle applications. Oracle shops with Internet-facing application servers are particularly at risk, it says.
Oracle’s advisory is here (PDF). ®
Related stories
Oracle discounts revealed in court
Oracle slashes PeopleSoft offer
Oracle 9i Database, Ap Server bust six ways to Sunday
How to hack unbreakable Oracle servers
Airport insecurity: the case of lost laptops
Jump start your Application Security initiatives
Reducing messaging and web security costs with managed services
Avoiding 7 common mistakes of IT security compliance
Extended Validation SSL Certificates
Feds: Hospital hacker's 'massive' DDoS averted
Buggy 'smart meters' open door to power-grid botnet
Microsoft knew of nasty IE bug a year before attacks
BlockMaster SafeStick hardware-encrypted USB drive