Date: Tue, 22 Jan 2002 10:12:28 -0500
From: Elan Hasson
To: bugtraq@securityfocus.com
Subject: "Dec. 6: Oracle server vulnerable on Unix"
Not sure if this was discussed on the list(i didn't see it), but saw
this on
msnbc.com today:
http://www.msnbc.com/news/668334.asp
"Dec. 6: Oracle server vulnerable on Unix"
"The Oracle database server has a security vulnerability on Unix
operating
systems. The problem occurs when a non-privileged user like ^Ã?nobody^Ã?
runs
the Oracle executable which has a SETUID bit. This can result in the
non-privileged user overwriting Oracle log files, creating new files,
and/or
changing the ORACLE_HOME environment variable. For a workaround remove
the
execute permissions for the ^Ã?other^Ã? group: %chmod o-x oracle.
Affected
versions: 8.0.x, 8.1.x, 9.0.1."
also linked to http://www.msnbc.com/news/BUGOFTHEDAY_Front.asp
Sorry if this has already been discussed.
