[20830] in bugtraq
Re: Vulnerability in Oracle E-Business Suite Release 11i Applications
daemon@ATHENA.MIT.EDU (Oracle Security Alerts)
Fri Jun 1 13:34:19 2001
Message-ID: <3B16D3AF.8FDD09BF@oracle.com>
Date: Thu, 31 May 2001 16:28:47 -0700
From: Oracle Security Alerts <secalert_us@oracle.com>
MIME-Version: 1.0
To: Pavel Machek <pavel@ucw.cz>
Cc: bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
In response to Pavel Machek's posting (dated 05/22/01), the server patch is
necessary and with the server security feature turned fully on, you would also
need to supply a pass-key associated with the machine from which you were
attempting to make the connection. This is intended to prevent access by
compromised code or malicious DLLs. Supported Oracle customers should go to
Metalink for more details and patch availability.
Regards,
Oracle Security Alerts
Pavel Machek wrote:
> Hi!
>
> Is it just me or does this sound like "security by obscurity"? What if I
> sit down and write evil PAVEL11I.DLL that *looks* like production one
> but dumps passwords as debug one?
>
> Looks to me like either *) server patch is unnecessary or *) you have
> security hole, anyway.
> Pavel
