Websecurity - Веб безпека

25.04.2012

Виявлені численні уразливості безпеки в продуктах Oracle, Sun, People Soft і MySQL.

Уразливі продукти: Oracle 10g, Oracle 11g, MySQL 5.1, MySQL 5.5, Oracle Application Server 10g, Oracle E-Business Suite Release 11i, PeopleSoft Enterprise HRMS 8.9, Oracle BI Publisher 10.1, PeopleSoft Enterprise CRM 9.1, PeopleSoft Enterprise SCM 9.0 та інші продукти Oracle.

Більше 90 уразливостей у різних продуктах усунуто в щоквартальному оновленні.

• The history of a -probably- 13 years old Oracle bug: TNS Poison (деталі)
• OCIPasswordChange API leaks information of password hash (деталі)
• Some failed authentication attempts using OCIPasswordChange API are not recorded (деталі)
• Incomplete protection of Oracle Database locked accounts (деталі)
• SQL Injection in Oracle Enterprise Manager (compareWizFirstConfig web page) (деталі)
• SQL Injection in Oracle Enterprise Manager (searchPage web page) (деталі)
• HTTP Response Splitting in Oracle Enterprise Manager (prevPage parameter) (деталі)
• HTTP Response Splitting in Oracle Enterprise Manager (pageName parameter) (деталі)
• OCIPasswordChange API leaks information of password hash (деталі)
• Oracle Enterprise Manager vulnerable to Session fixation (деталі)
• Oracle Critical Patch Update Advisory - April 2012 (деталі)

02.06.2012

Додаткова інформація.

• Re: The history of a -probably- 13 years old Oracle bug: TNS Poison (деталі)
• Oracle TNS Poison vulnerability is actually a 0day with no patch available (деталі)
• Patch Notification: Oracle Grid Engine sgepasswd Buffer Overflow (деталі)

This entry was posted on 16:07 02.06.2012 and is filed under Новини, Помилки. You can follow any responses to this entry through the RSS 2.0 feed.