As a side note.... This is not the only place that some "exposure" to the vulnerabilities had been "listed". There is at least 1 Security Company (possibly 3) that listed some details of 2 specific vulnerabilities!!! Geez, they should know better....... greg -----Original Message----- From: Mladen Gogala [mailto:gogala@xxxxxxxxxxxxx] Sent: Thursday, September 02, 2004 10:14 PM To: oracle-l@xxxxxxxxxxxxx Subject: Re: how can I best quantify my level of disgust? (oracle alert #68) On 09/02/2004 08:50:27 PM, Paul Drake wrote: > Mladen, > > Respected professionals do not publish exploit code prior to the > patches being widely deployed. I apologize. I shouldn't have done it. I was intrigued by sudden urgency and I decided to investigate. I must say that I didn't expect it to be so easy. Yes, you are right, I shouldn't have posted the exploit code. I didn't think much about it because there aren't many 10g databases in production, and the only affected release is 10.1.0.2. Also, the whole thing looked so trivial to me, and I knew that many other guys on this group would be able to figure it out, you among other people. I could list you at least 10 people from this group that could probably do it even faster then me, so the secrecy didn't seem very important. I will not post the exploit on comp.databases.oracle or anywhere else for that matter. Once again, I didn't want to make life harder for anyone and I apologize if I did. -- Mladen Gogala Oracle DBA --- To unsubscribe - mailto:oracle-l-request@xxxxxxxxxxxxx&subject=unsubscribe To read recent messages - //freelists.org/archives/oracle-l/09-2004 -- To unsubscribe - mailto:oracle-l-request@xxxxxxxxxxxxx&subject=unsubscribe To search the archives - //www.freelists.org/archives/oracle-l/