bugtraq - Re: Problems with the Oracle Critical Patch Update for April 2005

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 12 Jul 2005 05:58:38 +0100
From: "David Litchfield" <davidl@...software.com>
To: "Cesar" <cesarc56@...oo.com>, <bugtraq@...urityfocus.com>,
	<ntbugtraq@...tserv.ntbugtraq.com>, <vulnwatch@...nwatch.org>
Subject: Re: Problems with the Oracle Critical Patch Update for April 2005

Hi Cesar,
> We always test Oracle patches against the bugs we have
> reported to them just to be sure the patches work.
<SNIP>
> (10.1.0.4) applied (we tested the patch on this system
> after April CPU relase)

Yep; that's why at NGSSoftware we're absolutely thorough about testing these 
things. By only looking at one version, serious problems like this can slip 
through the net.

As it happens, after retesting, having used Oracle's suggested remediation:

exec sys.dbms_java.loadjava('-v -f -r -s -g public rdbms/jlib/CDC.jar');

there are _still_ problems. The new java classes are still not being loaded.

To properly fix the problem use the loadjava utility:

$ cd $ORACLE_HOME/bin
$ ./loadjava -user sys/password ../rdbms/jlib/CDC.jar

On all our systems executing the above solved the problem whereas the 
DBMS_JAVA.LOADJAVA procedure did not.

Cheers,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/