Channel News and Analysis - Channel Insider
Empowering the next generation Channel
 

Sponsored Links
  • Get up and running in as quickly as 30 days with BI. Learn how today.
  • FREE Securing Smartphones & Tablets for Dummies Book from Sophos
  • 5 New Technologies That Will Change Enterprise ITAdvertisement
  • Build an IT Infrastructure That Delivers the Future

    		•  

    Critical Flaw Uncovered in Oracle E-Business Suite, Applications

    in Channel News and Analysis



    DATE: 2004-06-09 | By Lisa Vaas
    Article Rating:starstarstarstarstar / 0
    Article Views: 1940

    A critical SQL injection vulnerability puts at risk Oracle Applications and E-Business Suite customers.

    Rate This Article:
    Poor Best
    Add This Article To:
    All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple, critical SQL injection vulnerabilities. The vulnerabilities were uncovered by Stephen Kost from the security firm Integrigy Corp. An alert put out by Integrigy last week described the flaw as being exploitable by a remote user who can send a specially crafted URL to a Web server via a browser.

    The risk level for the flaw is critical. Vulnerable versions include 11.5.1 through 11.5.8 of E-Business Suite. Release 11.5.9 is unaffected. Also at risk are both supported releases of Oracle Applications: 11.0 and 11i. All platforms are affected.

    For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer's Weblog.

    According to Integrigy's alert, all customers are at risk, since Oracle Applications 11i installs code for all product modules. According to an advisory sent out by Oracle (click here for a .PDF of the advisory), risk to exposure is high, since the flaw can be exploited by any user with a browser and the knowledge of how to exploit the flaw.

    The SQL injection vulnerability allows attackers to easily and effectively take over a database and application or to execute SQL statements. It works via the insertion of SQL code fragments into Web page input fields.

    Customers who face the highest risk are those with Internet-facing application servers, because such servers are vulnerable to remote attack with a browser. According to Integrigy's alert, attacks can be customized for Oracle Applications.

    An attack may take the form of one single HTTP Get or Post and can easily be designed to evade most intrusion detection and prevention systems.

    There is no workaround for these vulnerabilities. Oracle has released a patch to correct the problems, available in Oracle Metalink Note ID 274375.1.

    Check out eWEEK.com's Database Center at http://database.eweek.com for the latest database news, reviews and analysis.

    Be sure to add our eWEEK.com database news feed to your RSS newsreader or My Yahoo page




    comments dic


     
     
    >>> More Channel News and Analysis Articles          >>> More By Lisa Vaas
     



    		 


    Related Content

    Articles Labs/How-To Multimedia

    channel chatter


    HTML PLAIN TEXT

    Keep on top of news for VARs and Resellers with CI's Weekly Newsletter and Alerts.


    [ci] feeds
    XML
    Add Channel News, Product Reviews, Trends and Analysis to your RSS newsreader or My Yahoo!

     

    CHANNEL SPONSORED RESOURCE CENTER
     
     
     
    Start the New Year with business intelligence—it’s a smart move
    Join us on February 1 for an encore rebroadcast at either 5 am or 12 noon EST and discover how business intelligence (BI) supports companies in uncertain business and economic climates. Get expert advice on how to create a strategy that fits your organization's needs and budget and see how quickly it can pay for itself.
    Click Here
     
    Security and Availability Essentials for Running Your Business in the Cloud
    Are you moving to the cloud? Find out what every IT professional should know about security and availability before moving to the cloud. Hear what a security provider’s own CSO has to say.
    Watch Video
    A new algorithm automatically identifies relationships between variables to help reduce researcher prejudice.
    Click HereAdvertisement