bugtraq - Re: Recent Oracle exploit is _actually

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 28 Apr 2006 22:40:37 +0100
From: "David Litchfield" <davidl@...software.com>
To: "Kornbrust, Alexander" <ak@...-database-security.com>,
	"Cesar" <cesarc56@...oo.com>, "Steven M. Christey" <coley@...re.org>
Cc: <bugtraq@...urityfocus.com>
Subject: Re: Recent Oracle exploit is _actually_ an 0day with no patch


Alexander Kornbrust wrote:
>Currently I have 40+ OPEN/UNFIXED security issues in Oracle products. A
>detailed list from Oracle secalert (Report March 2006) can be found at
>the end of this email or (the latest version) on my webpage:

<SNIP>

>If Cesar, Esteban and David have a similar number of open security bugs,

Between my bugs, Paul Wright's and my brother Mark's, I can confirm 
NGSSoftware are waiting on 63 vulnerabilities being fixed. Over 80% of these 
issues are critical/high and allow an attacker to gain DBA privs.

Cheers,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/
+44 (0) 208 401 0070