Follow Slashdot stories on Twitter


Forgot your password?
Slashdot Deals: Deal of the Day - Pay What You Want for the Learn to Code Bundle, includes AngularJS, Python, HTML5, Ruby, and more. ×

Submission + - Critical Vuln Found In All Current Oracle DB Servers (

chicksdaddy writes: "There's a critical remotely exploitable vulnerability in all of the current versions of the Oracle database server that can enable an attacker to intercept traffic and execute arbitrary commands on the server. The bug, which Oracle reported as fixed in the most recent Critical Patch Update, is only fixed in upcoming versions of the database, not in currently shipping releases, and there is publicly available proof-of-concept exploit code circulating.

The vulnerability lies in the TNS Listener service, which on Oracle databases functions as the service that routes connection requests from clients to the server itself. A researcher named Joxean Koret said that he discovered the vulnerability several years ago and then sold the details of the bug to a third party broker, who reported it to Oracle in 2008. Oracle credited Koret for reporting the bug in its April CPU, but Koret said in a post on the Full Disclosure mailing list this week that the flaw was not actually fixed in the current versions of the Oracle database server."

This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

Critical Vuln Found In All Current Oracle DB Servers

Comments Filter:

Computers are unreliable, but humans are even more unreliable. Any system which depends on human reliability is unreliable. -- Gilb