full-disclosure - Oracle exploit? Where's the beef?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <c31ca9c604090108343d75f4b2@mail.gmail.com>
From: mshirley at gmail.com (Mark Shirley)
Subject: Oracle exploit? Where's the beef?

Does anyone know anything further about the new oracle exploit? It
seems no one is saying shit about it other then "it's bad, it affects
everything, patch patch patc".

This is the only url i could find that has anything remotely interesting.

http://www.ciac.org/ciac/bulletins/o-209.shtml

VULNERABILITY ASSESSMENT:  Oracle rates this as a HIGH. "Exploiting
some of the vulnerabilities requires network access, but no valid user
account."

Typical response from oracle,  "DAMAGE:  Oracle does not give
descriptions of the vulnerabilities on this alert."

Remote exploits are bad mmkay.