Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?

Submission + - Critical Vuln Found In All Current Oracle DB Servers (

chicksdaddy writes: "There's a critical remotely exploitable vulnerability in all of the current versions of the Oracle database server that can enable an attacker to intercept traffic and execute arbitrary commands on the server. The bug, which Oracle reported as fixed in the most recent Critical Patch Update, is only fixed in upcoming versions of the database, not in currently shipping releases, and there is publicly available proof-of-concept exploit code circulating.

The vulnerability lies in the TNS Listener service, which on Oracle databases functions as the service that routes connection requests from clients to the server itself. A researcher named Joxean Koret said that he discovered the vulnerability several years ago and then sold the details of the bug to a third party broker, who reported it to Oracle in 2008. Oracle credited Koret for reporting the bug in its April CPU, but Koret said in a post on the Full Disclosure mailing list this week that the flaw was not actually fixed in the current versions of the Oracle database server."

This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

Critical Vuln Found In All Current Oracle DB Servers

Comments Filter:

You know, Callahan's is a peaceable bar, but if you ask that dog what his favorite formatter is, and he says "roff! roff!", well, I'll just have to...