----------------------------------------------------------------------


  Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management

http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Oracle Database Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA39438

VERIFY ADVISORY:
http://secunia.com/advisories/39438/

DESCRIPTION:
Multiple vulnerabilities have been reported in Oracle Database, which
can be exploited by malicious users to compromise a vulnerable system,
and by malicious users and malicious people to disclose potentially
sensitive information or to manipulate certain data.

1) An error in the Oracle Internet Directory component can be
exploited to disclose or manipulate certain data.

For more information see vulnerability #1 in:
SA39439

2) An error in the Core RDBMS component can be exploited by
authenticated users to execute arbitrary code.

3) An error in the XML DB component can be exploited by authenticated
users to disclose or manipulate certain data.

4) Another error in the XML DB component can be exploited by
authenticated users to disclose certain data.

5) An error in the Change Data Capture component can be exploited by
authenticated users to disclose or manipulate certain data.

6) An error in the Audit component can be exploited by authenticated
users to manipulate certain data.

The vulnerabilities are reported in the following products and
versions:
* Oracle Database 11g Release 2, version 11.2.0.1
* Oracle Database 11g Release 1, version 11.1.0.7
* Oracle Database 10g Release 2, versions 10.2.0.3 and 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8 and 9.2.0.8DV

SOLUTION:
Apply patches (please see the vendor's advisory for details).

PROVIDED AND/OR DISCOVERED BY:
It is currently unclear who reported these vulnerabilities as the
Oracle Critical Patch Update for April 2010 only provides a bundled
list of credits. This section will be updated when/if the original
reporter provides more information.

ORIGINAL ADVISORY:
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html

OTHER REFERENCES:
SA39439:
http://secunia.com/advisories/39439/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------