SHARE
Facebook X Pinterest WhatsApp

Critical Flaw Uncovered in Oracle E-Business Suite, Applications

All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple, critical SQL injection vulnerabilities. The vulnerabilities were uncovered by Stephen Kost from the security firm Integrigy Corp. An alert put out by Integrigy last week described the flaw as being exploitable by a remote user who can send a specially […]

Written By
thumbnail Lisa Vaas
Lisa Vaas
Jun 9, 2004
Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple, critical SQL injection vulnerabilities. The vulnerabilities were uncovered by Stephen Kost from the security firm Integrigy Corp. An alert put out by Integrigy last week described the flaw as being exploitable by a remote user who can send a specially crafted URL to a Web server via a browser.

The risk level for the flaw is critical. Vulnerable versions include 11.5.1 through 11.5.8 of E-Business Suite. Release 11.5.9 is unaffected. Also at risk are both supported releases of Oracle Applications: 11.0 and 11i. All platforms are affected.

For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer’s Weblog.

According to Integrigy’s alert, all customers are at risk, since Oracle Applications 11i installs code for all product modules. According to an advisory sent out by Oracle (click here for a .PDF of the advisory), risk to exposure is high, since the flaw can be exploited by any user with a browser and the knowledge of how to exploit the flaw.

The SQL injection vulnerability allows attackers to easily and effectively take over a database and application or to execute SQL statements. It works via the insertion of SQL code fragments into Web page input fields.

Customers who face the highest risk are those with Internet-facing application servers, because such servers are vulnerable to remote attack with a browser. According to Integrigy’s alert, attacks can be customized for Oracle Applications.

An attack may take the form of one single HTTP Get or Post and can easily be designed to evade most intrusion detection and prevention systems.

There is no workaround for these vulnerabilities. Oracle has released a patch to correct the problems, available in Oracle Metalink Note ID 274375.1.

Check out eWEEK.com’s Database Center at http://database.eweek.com for the latest database news, reviews and analysis.

Be sure to add our eWEEK.com database news feed to your RSS newsreader or My Yahoo page

Recommended for you...

Manny Rivelo on Evolving Channel & How MSPs Can Get Ahead
Victoria Durgin
Aug 20, 2025
Databricks Raises at $100B+ Valuation on AI Momentum
Allison Francis
Aug 20, 2025
Keepit Achieves SOC 2 Type 1 & Canadian Ingram Micro Deal
Jordan Smith
Aug 20, 2025
AI Customer Service Fails to Satisfy Consumer Needs: Verizon
Franklin Okeke
Aug 19, 2025
Channel Insider Logo

Channel Insider combines news and technology recommendations to keep channel partners, value-added resellers, IT solution providers, MSPs, and SaaS providers informed on the changing IT landscape. These resources provide product comparisons, in-depth analysis of vendors, and interviews with subject matter experts to provide vendors with critical information for their operations.

Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.