Critical Flaw Uncovered in Oracle E-Business Suite, Applications

 
 
By Lisa Vaas  |  Posted 2004-06-09 Email Print this article Print
 
 
 
 
 
 
 

A critical SQL injection vulnerability puts at risk Oracle Applications and E-Business Suite customers.

All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple, critical SQL injection vulnerabilities. The vulnerabilities were uncovered by Stephen Kost from the security firm Integrigy Corp. An alert put out by Integrigy last week described the flaw as being exploitable by a remote user who can send a specially crafted URL to a Web server via a browser. The risk level for the flaw is critical. Vulnerable versions include 11.5.1 through 11.5.8 of E-Business Suite. Release 11.5.9 is unaffected. Also at risk are both supported releases of Oracle Applications: 11.0 and 11i. All platforms are affected. For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.
According to Integrigys alert, all customers are at risk, since Oracle Applications 11i installs code for all product modules. According to an advisory sent out by Oracle (click here for a .PDF of the advisory), risk to exposure is high, since the flaw can be exploited by any user with a browser and the knowledge of how to exploit the flaw.
The SQL injection vulnerability allows attackers to easily and effectively take over a database and application or to execute SQL statements. It works via the insertion of SQL code fragments into Web page input fields. Customers who face the highest risk are those with Internet-facing application servers, because such servers are vulnerable to remote attack with a browser. According to Integrigys alert, attacks can be customized for Oracle Applications. An attack may take the form of one single HTTP Get or Post and can easily be designed to evade most intrusion detection and prevention systems.
There is no workaround for these vulnerabilities. Oracle has released a patch to correct the problems, available in Oracle Metalink Note ID 274375.1. Check out eWEEK.coms Database Center at http://database.eweek.com for the latest database news, reviews and analysis.

Be sure to add our eWEEK.com database news feed to your RSS newsreader or My Yahoo page

 
 
 
 
Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date
Rocket Fuel