SecurityProNews Directory: A Directory For All Things Security

Oracle Patch Problems

It seems like everyone is having patch problems. On Tuesday, NGSResearchers discovered problems in Oracle’s most recent Critical Patch Update. The biggest problem stems from the patch’s failure to install the Oracle Text components on Oracle 8.1.7.4 on all operating systems.

SELECT DBMS_REGISTRY.SCRIPT(‘CONTEXT’,'@ctxcpu.sql’)….

the install script executes

SELECT DBMS_REGISTRY.SCRIPT(‘CTX’,'@ctxcpu.sql’)….

So, even if you have Oracle Text installed the patch installer will not
install the updated PL/SQL packages. The fall out from this means that your
servers may still be vulnerable to the Oracle Text flaws; these allow a low
privileged user to gain DBA privileges. Further, if the RDBMS is part of a
web application that uses Oracle Portal (OAS, IAS, Oracle HTTP Server) then
an attacker may exploit this from the Internet without a userID and
password.

To check if you are still vulnerable execute the following query

select owner,package_name,object_name from all_arguments where owner =


‘CTXSYS’ and package_name = ‘DRILOAD’ and object_name = ‘VALIDATE_STMT’;

If no row is returned then you are not vulnerable but if a row is returned
then you are vulnerable. In this case you should manually apply the
ctxcpu.sql script.

NGSSQuirreL for Oracle, the leading vulnerability assessment scanner for
Oracle RDBMSes, checks for these problems as well as the other many issues
that still afflict Oracle. More information about NGSSQuirreL can be found
here – http://www.ngssoftware.com/squirrelora.htm

They did comment later though that Oracle is improving their updates and Oracle is “beginning to treat security properly.”

This is just another in a series from large tech companies who are having real problems with their patches. Microsoft has had problems with their last three patches. In additional to Oracle, Symantec has also had problems and there are others. It would seem they need to improve their patchworking ability.

John Stith
About John Stith
John is a staff writer for SecurityProNews covering cyber security.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>