Oracle issues 'high' alert over E-Business Suite vulnerability

By Alun Williams

Posted on 11 Jun 2004 at 11:07

Oracle has alerted users of its Oracle E-Business Suite to vulnerabilities that allow an attacker to execute unauthorised procedures or SQL inside the database.

The flaws were discovered by Integrigy, an enterprise application security company. They are termed 'SQL injection' vulnerabilities and can be remotely exploited, via a browser, by sending specially crafted URLs to the web server hosting the Suite.

Oracle is strongly recommending that customers apply a patch made available as no work around exists for the flaw. It describes the risk as 'high' because any hacker with browser access can exploit the vulnerabilities.

Software affected comprises: Oracle E-Business Suite Release 11i and 11.5.1 through 11.5.8. Release 11.5.9 and later releases are not affected, however.

You can read more details on the Oracle Technology Network website, with patches available from the MetaLink website.