[Full-Disclosure] Oracle Database 9ir2 Interval Conversion Functions Buffer Overflow
cesarc56 at yahoo.com
Fri Feb 6 01:13:37 GMT 2004
Don't worry, Oracle sucks, probably they won't say
Just to clarify(oh my god, i feel sorry about Oracle
users, it's a pain in the ass to find the correct
patches, to install them, etc.) the patch that fix
these vulnerabilities is Patch 3 from January 2 it
goes on top of Patchset 3 (188.8.131.52). If you (all
people) don't understand don't worry i also don't
understand much this Oracle patch stuff:), but if you
are paying to get the patches and support then it
should be easy, shouldn't be?
--- Chris Anley <chris at ngssoftware.com> wrote:
> > Hey Chris.
> Hey Cesar.
> > First of all, your advisories are a bit wrong:
> > ...Systems Affected: Oracle 9 prior to 184.108.40.206
> > Actually Systems affected are Oracle 9 prior to
> > 220.127.116.11 (Patchset 3).
> > The date in Metalink site of the Patch that fixes
> > these vulnerabilities is January 2 and your
> > are from December.
> > I could be wrong, Oracle patches numeration,
> > etc. really sucks, but you could be wrong too as
> > version of Oracle your advisory said it was
> > :).
> Interesting. The information we had direct from
> Oracle was that
> these issues were fixed in 18.104.22.168. Perhaps Oracle
> could resolve the
> discrepancy? I'm willing to believe that either, or
> neither of
> us is right :o)
> > The fact is that i contacted Oracle before the fix
> > available, they released the fix and they didn't
> > me anything, they didn't released any public alert
> > your advisory isn't in any public list, it's only
> > your site. Finally, given that the date of the
> > that fixes these vulns is January 2, you published
> > advisories in your site before the fix was
> > Again i could be wrong.
> As I say, we had definitive information from Oracle
> that the issues were
> fixed in 22.214.171.124; we've heard nothing to the
> contrary from Oracle or
> anyone else up until your post. So it would be good
> to get to the
> bottom of this; there's definitely a communication
> breakdown somewhere.
> > BTW: i'm curious, Why you didn't posted those
> > advisories to public mailing lists?
> As far as we were concerned, these were old bugs. If
> current versions
> aren't affected, or if the bugs are of low severity,
> we tend not to issue
> advisories to mailing lists.
> Full-Disclosure - We believe in it.
Do you Yahoo!?
Yahoo! Finance: Get your refund fast by filing online.
Full-Disclosure is hosted and sponsored by Secunia.