full-disclosure - SV: [SHATTER Team Security Alert] Multiple vulnerabilities in Oracle Database Server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAEFKJBBCIPAKCGNHICFAEDOECAA.kruse@krusesecurity.dk>
From: kruse at krusesecurity.dk (Peter Kruse)
Subject: SV: [SHATTER Team Security Alert] Multiple vulnerabilities in Oracle Database Server

Hi,

>Actually this sounds like someone stole Litchfield's research -
>but what do I
>know.  Just seems like too much coincidence since his last talk dealt with
>procedure based vulns.

No, these are separate issues.

This is a coordinated update that fixes multiple vulnerabilities in Oracle.
Details from NGSSoftware won't be disclosed until after 3 months. However,
the advisory publiced by Application Security Inc. contains sufficient data
that could be abused to start exploiting Oracle databases immediately.

Kind regards
Peter Kruse
http://www.csis.dk