Bugtraq mailing list archives
Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11)
From: Joxean Koret <joxeankoret () yahoo es>
Date: Sat, 10 Jan 2009 19:26:32 +0100
Hi, This is very typical and, in my opinion, you should only consider trustworthy the Team Shatter's advisory, not the Oracle's one. Take for example the bug APPS01[1] in Oracle Critical Patch Update of April 2007 [2], it was a preauthenticated remote bug (with remote I mean "from internet", not from "adjacent network"). CVSS2 Score would be 9/10 (calcule it yourself [3]), however, the Oracle advisory says that a "Valid session" was needed and that the CVSS2 score was 4.2. It's funny.
As a responsible security professional, I have to assume their research is accurate and their advisory should be taken more seriously than Oracle's.
Yes, don't trust the Oracle's advisories, the aren't real. [1]http://www.zerodayinitiative.com/advisories/ZDI-08-088 [2] http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html [3] http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 Thanks, Joxean Koret On Sat, 2009-01-10 at 11:11 +0000, security curmudgeon wrote:
Summary: Team SHATTER says this is a remote overflow that allows for the execution of arbitrary code (CVSS2 9.0). Oracle says this is a limited DoS condition (CVSS2 4.0). That is a big discrepancy.
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11) security curmudgeon (Jan 10)
- Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11) Joxean Koret (Jan 10)
- RE: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (Oracle CPU April 2008 DB11) Integrigy Alerts (Jan 12)
- Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11) Joxean Koret (Jan 10)