SHATTER Security Alerts

DbProtect AppRadar Filters™ - 18 January 2007

Oracle Critical Patch Update - January 2007

Oracle has released the January 2007 CPU that patches and explains known vulnerabilities located within an Oracle database. While providing a patch reduces overall security threats, Application Security, Inc. understands that when a patch is initially released, the threat risk actually increases. The window of highest risk begins with the release of the CPU and ends when those systems are patched.

DbProtect AppRadar, a solution that provides continuous database activity monitoring, helps to manage and reduce this risk throughout the patch management life-cycle. Application Security, Inc. publishes DbProtect AppRadar Filters to specifically monitor the vulnerabilities related to Oracle CPUs.

Please check back periodically over the next several weeks. Our Team SHATTER will be updating these Filters, to cover more vulnerabilities and to add additional information, as more detail becomes available to the public. The DbProtect AppRadar Filters currently address the following vulnerabilities:

• Buffer overflow in sys.dbms_drs.get_property by sysdba
• Buffer overflow in sys.dbms_logmnr.add_logfile by sysdba
• Denial of service and buffer overflows in mdsys.md.hh* procedures
• Buffer overflow in sys.dbms_repcat_untrusted.unregister_snapshot by sysdba
• Buffer overflow in sys.dbms_logrep_util.get_object_namE
• Buffer overflow in SYS.DBMS_CAPTURE_ADM_INTERNAL.CREATE_CAPTURE,ALTER_CAPTURE, ABORT_TABLE_INSTANTIATION by sysdba
• SQL Injection in package sys.dbms_aq_inv
• Buffer overflow in sys.dbms_cdc_subscribe
  
  Downloading and Applying Filters in DbProtect AppRadar

• Download this DbProtect AppRadar filter (version 2.0)

(1) Import the Oracle CPU focused monitoring Filters
(2) Add the Filters to the appropriate Policies
(3) and redeploy the Policies to the databases

More detailed directions instructions can be found here.