Original URL: http://www.theregister.co.uk/2012/08/15/oracle_pushes_unscheduled_database_patch/

Oracle slaps surprise patch over database server hole

Went to Black Hat and all we got was this lousy security flaw

By John Leyden

Posted in Security, 15th August 2012 11:49 GMT

Oracle has broken its regular quarterly patch update cycle with a fix for a security flaw publicised at last month's Black Hat conference.

The vulnerability in Oracle's database server was demonstrated by David Litchfield, the celebrated white-hat hacker Brit. Oracle released a security update for server versions 11.2.x soon after Litchfield's Vegas talk last month.

The privilege elevation bug means developers (but not ordinary users or common proles) can gain administrative rights on systems, provided a vulnerable Oracle Text module is installed. The security flaw is not remotely exploitable without authentication and even then CREATE TABLE, CREATE PROCEDURE and EXECUTE privileges are needed for any badness to be possible, according to Oracle.

Nonetheless, exploits for the vulnerability are being circulated in the wild, so patching ought to take place sooner rather than later. Server versions 10.2.x and 11.1.x are affected by the flaw and older unsupported versions of Oracle's flagship product may be vulnerable too.

Oracle's security alert can be found here. A more detailed overview can be found in a blog post by by Alex Rothacker, of database security outfit Team Shatter, here. ®