Risk: Medium
All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple SQL injection vulnerabilities, all being described as critical.
Vulnerable versions include 11.5.1 through 11.5.8 of E-Business Suite. Release 11.5.9 is unaffected. Also at risk are both supported releases of Oracle Applications: 11.0 and 11i. All platforms are affected.
According to the alert, all customers are at risk, since Oracle Applications 11i installs code for all product modules. According to an advisory sent out by Oracle, risk to exposure is high, since the flaw can be exploited by any user with a browser and the knowledge of how to exploit the flaw.
The SQL injection vulnerability allows attackers to easily and effectively take over a database and application or to execute SQL statements. It works via the insertion of SQL code fragments into Web page input fields.
Customers who face the highest risk are those with Internet-facing application servers, because such servers are vulnerable to remote attack with a browser.
An attack may take the form of one single HTTP Get or Post and can easily be designed to evade most intrusion detection and prevention systems.
There is no workaround for these vulnerabilities. Oracle has released a patch to correct the problems, available in Oracle's metalink support database, ID 274375.1.