Oracle Exploitation

[Gary Flynn <flynngn () JMU EDU>]

Various organizations have recently reported active
exploitation of the Oracle FTP XDB service listening
on port 2100. We've seen recent corroborating evidence
here. Note that the Oracle HTTP XDB service is also
vulnerable and that it listens on port 8080 which
may more often be exposed to the Internet and, perhaps,
less monitored.

The Oracle version at risk is 9.2.0.1.

http://oit.ohio.gov/alerts/OracleXDBFTPServicesBufferOverflowVulnerabilityisbeingexploitedinthewild.aspx
http://www.cscic.state.ny.us/advisories/mar05/3_30.htm
http://www.oracle.com/technology/deploy/security/pdf/2003Alert58.pdf

--
Gary Flynn
Security Engineer
James Madison University

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.