Critical Flaw Uncovered in Oracle E-Business Suite, ApplicationsBy Lisa Vaas | Posted 2004-06-09 Email Print
Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce
A critical SQL injection vulnerability puts at risk Oracle Applications and E-Business Suite customers.All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple, critical SQL injection vulnerabilities. The vulnerabilities were uncovered by Stephen Kost from the security firm Integrigy Corp. An alert put out by Integrigy last week described the flaw as being exploitable by a remote user who can send a specially crafted URL to a Web server via a browser.
The risk level for the flaw is critical. Vulnerable versions include 11.5.1 through 11.5.8 of E-Business Suite. Release 11.5.9 is unaffected. Also at risk are both supported releases of Oracle Applications: 11.0 and 11i. All platforms are affected.
Customers who face the highest risk are those with Internet-facing application servers, because such servers are vulnerable to remote attack with a browser. According to Integrigy's alert, attacks can be customized for Oracle Applications.
An attack may take the form of one single HTTP Get or Post and can easily be designed to evade most intrusion detection and prevention systems.
There is no workaround for these vulnerabilities. Oracle has released a patch to correct the problems, available in Oracle Metalink Note ID 274375.1.
Check out eWEEK.com's Database Center at