NTA Monitor

Latest News

Living with threats

1st August 2010 Back in 2004, Bill Gates predicted that spam would be a thing of the past within two years. As we all know now, and quite a lot of people predicted at the time, far from being a solved problem, the volume of spam has continued to increase. Read More

Web application security goes from bad to worse in many sectors

27th July 2010 NTA Monitor's 2010 Annual Web Application Security Report analysed the data gathered from web application security tests performed for a wide range of industry sectors over a 12-month period... Read More

IT Managers get to grips with Internet security issues

4th May 2010 According to NTA Monitor's 2010 Annual Security Report, the average number of Internet security vulnerabilities afflicting organisations has fallen.. Read More

Responsible Patching

1st January 2010 Microsoft's response to the "zero day" exploit that was used in the cyber attacks against Google shows that software vendors still have a lot to learn when it comes to responding to vulnerabilities. Read More
Date: 30th May 2003
Risk: Medium

Oracle’s Concurrent Manager server, the standard database server for Oracle and also the front end, contains a vulnerability within the FNDFS file server within it that is used by the RRA (Report Review Agent) when retrieving reports or logs.

The flaw allows an attacker with access to an Oracle SQL*Net port to retrieve any file from the Oracle system, bypassing all authentication checks. Such file access could allow the attacker to retrieve critical files, such as those containing valid username/password combinations, to become a stepping stone on the route to full compromise. Enterprises which have a Firewall blocking external access to SQL*Net ports will not be vulnerable, except from an internal attack. Oracle have released a patch which adds a new security layer.

References

http://mercury.nta-monitor.com/mailing-list-archive/vulnw-l/2003/04/0020.html http://otn.oracle.com/deploy/security/pdf/2003alert53.pdf