"Database software maker Oracle warned customers using the most recent version of its e-commerce program of a flaw that puts their systems at risk. In a terse but strongly worded advisory released to customers last week, Oracle said a software flaw in its Oracle 11i E-Business Suite and its Oracle Applications 11.0 could let an attacker take control of the database that powers the programs," reports CNet.
"The vulnerability was discovered by Stephen Kost, chief technology officer for Integrigy, a company focused on creating software to secure critical corporate applications. Integrigy's own advisory jibed with Oracle's on the ease with which the flaw could be exploited. 'Since attacks can be specially crafted for Oracle Applications and an attack may only be a single (HTTP, or Hypertext Transfer Protocol, request), successful attacks can be easily designed that will evade most intrusion detection and prevention systems,' Integrigy said in its advisory."
Comment: Oracle security holes provide some pleasure because Oracle boss Larry Ellison claimed Oracle 9i was "unbreakable" and "impenetrable" -- it could never be broken into. Within a few hours of this claim, David Litchfield of NGS Software demonstrated several vulnerabilities in the Oracle 9i Application Server, and showed how an attacker could gain remote root.
Oracle's prime customer is the CIA.
