Re: Analysis of the Oracle October 2006 Critical Patch Update

--===============0831620948==
Content-Type: multipart/signed; micalg=sha1;
	protocol="application/pkcs7-signature";
	boundary="==========1E783A81FC9321929438=========="

--==========1E783A81FC9321929438==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Thanks, David, for your always enlightening (and depressing if you use=20
Oracle products) reports on the unbreakable database.

--On Wednesday, October 18, 2006 07:55:35 +0100 David Litchfield=20
<[email protected]> wrote:

> Hey all,
> I've just posted an analysis of the 22 Oracle RDBMS flaws patched by the
> October 2006 Critical Patch Update that was released yesterday:
> http://www.oracle.com/technology/deploy/security/critical-patch-updates/c
> puoct2006.html.  Further, it's a shame to see that, after a promising
> July 2006 CPU where  Oracle had all the patches ready *on time*, they
> have slipped back into  their old, bad habits - patches are not ready for
> a number of platforms. I  thought they'd solved those issues - but
> clearly not. You can get a copy of  the analysis from
> http://www.databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf,
> Cheers,
> David Litchfield
> NGSSoftware Ltd
> http://www.ngssoftware.com/
> +44(0) 208 401 0070
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/



Paul Schmehl ([email protected])
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

--==========1E783A81FC9321929438==========
Content-Type: application/pkcs7-signature
Content-Transfer-Encoding: base64

MIIP8QYJKoZIhvcNAQcCoIIP4jCCD94CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3
DQEHAaCCDN4wggX3MIIFYKADAgECAhAb+r0Vn83hXsGxwNjMkhv+MA0GCSqGSIb3
DQEBBAUAMIHqMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBTeXN0
ZW0xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRl
cm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTk5
MTIwMAYDVQQLEylDbGFzcyAyIENBIC0gT25TaXRlIEluZGl2aWR1YWwgU3Vic2Ny
aWJlcjEtMCsGA1UEAxMkVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFz
IENBMB4XDTA2MDgzMTAwMDAwMFoXDTA3MDgzMTIzNTk1OVowgfQxJzAlBgNVBAoU
HlRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIFN5c3RlbTEtMCsGA1UECxQkVGhlIFVu
aXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFzIENBMUYwRAYDVQQLEz13d3cudmVy
aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC4gYnkgUmVmLixMSUFCLkxU
RChjKTk5MRgwFgYDVQQLFA9NYWlsIFN0b3AgLSBVVEQxFTATBgNVBAMTDFBhdWwg
U2NobWVobDEhMB8GCSqGSIb3DQEJARYScGF1bHNAdXRkYWxsYXMuZWR1MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA03eaA3yUOe6xXDyJUoOXJF3KYSzM
WoGSiGi+YgIiItjJl5WJADUIdw31JggmsiMaj4QXPemwmKZ0DRYYYqhoZzbG2ME8
U1cC9fpJgtcbVQFQKwvT+Ghqy2VE6fuWAL9muUjVTfToTjTG2UWEVRhjgp1sq3Ag
focFCU4pD3Iv4SZieNDeH24OGj3C64lVFJVLB71IsBffScItbSpfvF+AL9Deibhh
CNvc/SHHlz6T+JhZBkOBcweFds6ONiNFy9vQ5YjTOq2Tjd6GbNiSKYhHCD/GM57p
5kR9TM/83xzbK5MQyWDKifsHoRERa4OJWa40p3m4es8bkJ/iXPoEuv3riQIDAQAB
o4ICDDCCAggwCQYDVR0TBAIwADAdBgNVHREEFjAUgRJwYXVsc0B1dGRhbGxhcy5l
ZHUwggEkBgNVHSAEggEbMIIBFzCCARMGC2CGSAGG+EUBBwEGMIIBAjArBggrBgEF
BQcCARYfaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYS1rcjCB0gYIKwYBBQUH
AgIwgcUagcJOT1RJQ0U6IFByaXZhdGUga2V5IG1heSBiZSByZWNvdmVyZWQgYnkg
VmVyaVNpZ24ncyBjdXN0b21lciB3aG8gbWF5IGJlIGFibGUgdG8gZGVjcnlwdCBt
ZXNzYWdlcyB5b3Ugc2VuZCB0byBjZXJ0aWZpY2F0ZSBob2xkZXIuICBVc2UgaXMg
c3ViamVjdCB0byB0ZXJtcyBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBh
LWtyIChjKTk5LjARBglghkgBhvhCAQEEBAMCB4AwdQYDVR0fBG4wbDBqoGigZoZk
aHR0cDovL29uc2l0ZWNybC52ZXJpc2lnbi5jb20vVGhlVW5pdmVyc2l0eW9mVGV4
YXNTeXN0ZW1UaGVVbml2ZXJzaXR5b2ZUZXhhc2F0RGFsbGFzQ0EvTGF0ZXN0Q1JM
LmNybDALBgNVHQ8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMC
MA0GCSqGSIb3DQEBBAUAA4GBAHsCedl0/+AxFmHmikfEoE3NA10R+/cXrE3VAqqe
PcDSVFDNtLHG4Dc2Zb6lCqZeQuRF3xEZBV1f2u9qbkBt4O9EqOqI3SXLpfxgOO1A
WvFJopJCbiCwDzrqrb2e5UGmdlPZy14dFgW6WkE+yZx0MO5GjuZPasiejb/NubBR
K23TMIID2DCCA0GgAwIBAgIQQewfPacUB5bE9tUM3dEPZTANBgkqhkiG9w0BAQUF
ADCBwTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTwwOgYD
VQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y
aXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWduLCBJbmMuIC0gRm9y
IGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l
dHdvcmswHhcNOTkwMzMxMDAwMDAwWhcNMDkwMzMwMjM1OTU5WjCB6jEnMCUGA1UE
ChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJp
U2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0
cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3Mg
MiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIFN1YnNjcmliZXIxLTArBgNVBAMTJFRo
ZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IERhbGxhcyBDQTCBnzANBgkqhkiG9w0B
AQEFAAOBjQAwgYkCgYEAv+rvh+seCsEA+SIRwdHBzNt62r420nBgMGDlGeBTLzX0
yagpBdbePZ3zBppkfb7Rh1R4m/+iePH7h6vD/IdMwklBDeHA0qXX/H7/QlFOdPMB
1WhzpV0EMfjmKSVjqCOaRGqBiw+wOfHv20ZYw7q4z0vzesGiSZWDI0O6mxqPMoUC
AwEAAaOBpTCBojApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVs
MS0xNDAwEQYJYIZIAYb4QgEBBAQDAgEGMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEH
AQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL1JQQTAP
BgNVHRMECDAGAQH/AgEAMAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQUFAAOBgQBT
CbXcsraJ0SBQg8k4edzICLJJv7hTg2+KzLLkenz8o+gPX2FeX5cElRJa0pUBIvG8
7fFUtlSmVBihnVS8BmkExwIhN6KCOYinrKCf6IMZXZJIORpZgiQgQ7yGlRLcg3Th
5uMTvmqkhwAxMSMHJZuvuixRkQ5ZpqMXiNK0zlQXHDCCAwMwggJsAhEAuS9gzIif
oXpGCbhbcGyKrzANBgkqhkiG9w0BAQUFADCBwTELMAkGA1UEBhMCVVMxFzAVBgNV
BAoTDlZlcmlTaWduLCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmlt
YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAx
OTk4IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmswHhcNOTgwNTE4MDAwMDAwWhcN
MjgwODAxMjM1OTU5WjCBwTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWdu
LCBJbmMuMTwwOgYDVQQLEzNDbGFzcyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5IC0gRzIxOjA4BgNVBAsTMShjKSAxOTk4IFZlcmlTaWdu
LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNVBAsTFlZlcmlT
aWduIFRydXN0IE5ldHdvcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKeI
ASF0LOcaA/CY4Zc8DyEI8Zzbl+ma/MIEBhO+X1LIzB4sElYsuAFpLMyZH62wlq55
BPITOcF7mLoILOjChBMsqmnpCfTHqQKkQsIjT0rY8A6i+zFsyeZvmScH9eb0THie
betGhvq5hslU8rLEr9RGHFrJFTD/DWz1LQ5tzn93AgMBAAEwDQYJKoZIhvcNAQEF
BQADgYEAci75f9HxcfvEnvbFXlGKQJi4aPibHIPY4p29/+2h5mbqLwn0ytfqpSuV
9iRghk1ELoOlxC2g0654aW9y2myuCPBjkjfmu8QwF613zEk1qs/Yj9G+txiWR3Nq
VCI0ZC22FptZW7RRWTqzCxT0Et9noPStMmResUZyJ4wSe8VEtK4xggLbMIIC1wIB
ATCB/zCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgU3lzdGVt
MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJt
cyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYyk5OTEy
MDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRpdmlkdWFsIFN1YnNjcmli
ZXIxLTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IERhbGxhcyBD
QQIQG/q9FZ/N4V7BscDYzJIb/jAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3DQEJAzEL
BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA2MTAxODE0MTgzOVowIwYJKoZI
hvcNAQkEMRYEFDd27V6upgggOu/SEq4bbYShNNmAMFIGCSqGSIb3DQEJDzFFMEMw
CgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsO
AwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBADRW5BfeQJNqO6pA
fkWTklg73Fcggj/Jb2/ZQTGM+1dCfegPQNhPFuDGfnjnq9+fr6KXZ4EXS6VkL25F
qGEstD0sGZa7mIgwO3qB1BLcvtHzIHteyfpAPXrP5VqPaUeIIIkZcbJO5gEY1TjW
TCDNFs/vT/GLXY6+SyArDP0h2aNHWAGzxU9RhQBtQrJ+QaU2SHcRYvaDJ4wwjQs7
SuiahwYMsqQxeLeou00OmH3e+HTlnG4OPwaPmsN2et8FM+jn3zChMq24oFleGAUx
b8OFF+o5/xmxcOf4AOY0Xbf+OcLL+S01N/w501t8fxgyNCeTd6fb4qLmfe1D66oq
Ov+iflI=

--==========1E783A81FC9321929438==========--


--===============0831620948==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============0831620948==--