bugtraq - Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 10 Jan 2009 19:26:32 +0100
From: Joxean Koret <joxeankoret@...oo.es>
To: security curmudgeon <jericho@...rition.org>
Cc: Team SHATTER <shatter@...secinc.com>, bugtraq@...urityfocus.com,
	secalert_us@...cle.com
Subject: Re: Team SHATTER Security Advisory: Oracle Database Buffer
	Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11)

Hi,

This is very typical and, in my opinion, you should only consider
trustworthy the Team Shatter's advisory, not the Oracle's one.

Take for example the bug APPS01[1] in Oracle Critical Patch Update of
April 2007 [2], it was a preauthenticated remote bug (with remote I mean
"from internet", not from "adjacent network"). CVSS2 Score would be 9/10
(calcule it yourself [3]), however, the Oracle advisory says that a
"Valid session" was needed and that the CVSS2 score was 4.2. It's funny.

>As a responsible security professional, I have to assume their research
>is accurate and their advisory should be taken more seriously than
>Oracle's.

Yes, don't trust the Oracle's advisories, the aren't real.

[1]http://www.zerodayinitiative.com/advisories/ZDI-08-088
[2]
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2007.html
[3] http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2

Thanks,
Joxean Koret

On Sat, 2009-01-10 at 11:11 +0000, security curmudgeon wrote:
> 
> Summary: Team SHATTER says this is a remote overflow that allows for
> the 
> execution of arbitrary code (CVSS2 9.0). Oracle says this is a
> limited 
> DoS condition (CVSS2 4.0). That is a big discrepancy.
> 

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)