Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Recent Oracle exploit is _actually_ an 0day with no patch

from [Steven M. Christey] Network Security [Permanent Link]
Subject: Re: Recent Oracle exploit is _actually_ an 0day with no patch
Date: Thu, 27 Apr 2006 18:54:12 -0400 (EDT) 


The recent Oracle exploit posted to Bugtraq
(http://www.securityfocus.com/archive/1/431353) is actually an 0day
and has no patch.


The referenced exploit seems to use GET_DOMAIN_INDEX_METADATA with a
TYPE_NAME that references an attacker-defined package with a
(modified?) ODCIIndexGetMeta function.

Your last example uses GET_V2_DOMAIN_INDEX_TABLES, with arguments that
reference an attacker-defined package with a (modified?)
ODCIIndexUtilGetTableNames function.

Is this a surface-level discrepancy, or is your vector substantively
different than the one in the exploit?  If these are different, then
is it possible that last week's exploit was actually fixed?

- Steve

P.S. For those of you who are paying attention at this excruciating
level of detail, it seems that David's original use of
GET_DOMAIN_INDEX_METADATA in 2004 directly included the code in the
NEWBLOCK argument, whereas last week's exploit was performed through
an indirect reference to the code in the TYPE_NAME argument.
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  BL4's SMTP server BufferOverflow Vulnerable, the_day
Next by Date:  Secunia Research: Servant Salamander unacev2.dll Buffer Overflow Vulnerability, Secunia Research
Previous by Thread:  Recent Oracle exploit is _actually_ an 0day with no patch, David Litchfield
Next by Thread:  Re: Recent Oracle exploit is _actually_ an 0day with no patch, David Litchfield
Indexes:  [Date] [Thread] [Top] [All Lists]