Oracle accidentally let slip details last week on a security flaw it has yet to patch.
The business software giant is usually secretive about security and critical of researchers who publicly discuss flaws in Oracle products. But on April 6, it itself published a note on its MetaLink customer Web site with details about an unfixed flaw, Alexander Kornbrust, an independent researcher who specialises in Oracle security, said on his Web site on Monday.
Oracle confirmed the accidental posting. "Information regarding a security vulnerability was inadvertently posted to MetaLink," a representative for the company said on Tuesday. "We are currently investigating events that led to the posting."
The flaw in question affects versions 9.1.0.0 through 10.2.0.3 of Oracle's database software running on any operating system. Not only did the posting reveal details of the vulnerability, it also included computer code to test it, said Kornbrust, who runs Germany's Red Database Security and often hunts for bugs in Oracle products.
The MetaLink posting was taken down. Yet, because of the posting, Kornbrust believes the issue is now public knowledge and the bug information should be shared publicly.
"Database administrators and developers who missed the note on MetaLink should know of this vulnerability, in order to avoid or mitigate the risk, if possible, while waiting for a patch from Oracle," Kornbrust said.
The flaw opens the door to privilege escalation, meaning that database users with limited privileges could take advantage of it to gain more rights. "Depending on the architecture of the application, it is possible to modify data, escalate privileges — for example, change database passwords," Kornbrust wrote.
The vulnerability arises from an error in handling certain "views" created by unprivileged users, according to an FrSIRT advisory. Analysts at the French security firm deem the issue of "moderate risk".
Oracle has no fix publicly available, but the next edition in its regular Critical Patch Update is scheduled for release on Tuesday. "We plan to provide our customers a patch that addresses this vulnerability in a future quarterly Critical Patch Update," the Oracle representative said, but could not say if it would arrive next week.
