Status Tracking Note TRTA08-017A

Oracle Updates for Multiple Vulnerabilities

Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include remote execution of arbitrary code, information disclosure, and denial of service.

Event Information

Date (UTC)	Description
2008-01-28	Bugtraq Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP - SQL Injection Exploit (get password Hashes) Vulnerability Proof Of Concept #Cid: 27229-XDB_PITRIG_PKG.PITRIG_DROP.sql #Tested: oracle 10.1.0.2.0
2008-01-28	Bugtraq Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_TRUNCATE - SQL Injection Exploit (get password Hashes) Vulnerability Proof Of Concept #Cid: 27229-XDB_PITRIG_PKG.PITRIG_TRUNCATE.sql #Tested: oracle 10.1.0.2.0
2008-01-28	Bugtraq Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP - SQL Injection Exploit (change system password) Vulnerability Proof Of Concept #Cid: 27229-XDB_PITRIG_PKG.PITRIG_DROP-2.sql #Tested: oracle 10.1.0.2.0
2008-01-28	Bugtraq Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_TRUNCATE - BUFFER OVERFLOW (POC exploit , Crash database) Vulnerability Proof Of Concept #Cid: 27229-XDB_PITRIG_PKG.PITRIG_TRUNCATE-2.sql #Tested: oracle 10.1.0.2.0
2008-01-17 19:42	US-CERT TA08-017A: Oracle Updates for Multiple Vulnerabilities Via US-CERT Mailing List Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include remote execution of arbitrary code, information disclosure, and denial of service.
2008-01-17 13:30	Hewlett-Packard HPSBMA02133: SSRT061201 rev.7 - HP Oracle for OpenView (OfO) Critical Patch Update
2008-01-16 18:18	US-CERT Oracle Releases October Critical Patch Update US-CERT Current Activity Oracle has released their Critical Patch Update (CPU) for January 2008 to address 26 vulnerabilities across several products. This CPU contains eight security fixes for Oracle Database products; six for Oracle Application Server; one for Oracle Collaboration Suite; seven for Oracle E-Business Suite; and four for Oracle PeopleSoft Enterprise PeopleTools.
2008-01-15 22:55	Oracle Oracle Critical Patch Update Advisory - January 2008
2008-01-15 21:02	SANS Internet Storm Center Oracle releases January 2008 Critical Patch Update The January 2008 Critical Patch Update contains 27 security fixes, of which the highest CVSS score is 6.8 for servers and 9.3 for Application Server clients.


Date first published (UTC):	2008-01-21T10:58+00:00
Date last updated (UTC):	2008-02-25T02:10+00:00