RE: how can I best quantify my level of disgust? (oracle alert #6 8)

  • From: "Loughmiller, Greg" <greg.loughmiller@xxxxxxxxxxxx>
  • To: "'oracle-l@xxxxxxxxxxxxx'" <oracle-l@xxxxxxxxxxxxx>
  • Date: Fri, 3 Sep 2004 13:10:23 -0400

As a side note....
This is not the only place that some "exposure" to the vulnerabilities had
been "listed". There is at least 1 Security Company (possibly 3) that listed
some details of 2 specific vulnerabilities!!!

Geez, they should know better.......


-----Original Message-----
From: Mladen Gogala [mailto:gogala@xxxxxxxxxxxxx] 
Sent: Thursday, September 02, 2004 10:14 PM
To: oracle-l@xxxxxxxxxxxxx
Subject: Re: how can I best quantify my level of disgust? (oracle alert #68)

On 09/02/2004 08:50:27 PM, Paul Drake wrote:
> Mladen,
> Respected professionals do not publish exploit code prior to the
> patches being widely deployed.

I apologize. I shouldn't have done it. I was intrigued by sudden urgency
and I decided to investigate. I must say that I didn't expect it to be
so easy. Yes, you are right, I shouldn't have posted the exploit code.
I didn't think much about it because there aren't many 10g databases in
production, and the only affected release is Also, the whole
thing looked so trivial to me, and I knew that many other guys on this
group would be able to figure it out, you among other people. I could
list you at least 10 people from this group that could probably do it 
even faster then me, so the secrecy didn't seem very important. I will
not post the exploit on or anywhere else for that
matter. Once again, I didn't want to make life harder for anyone and I
apologize if I did.

Mladen Gogala
Oracle DBA
To unsubscribe - mailto:oracle-l-request@xxxxxxxxxxxxx&subject=unsubscribe 
To read recent messages -

To unsubscribe - mailto:oracle-l-request@xxxxxxxxxxxxx&subject=unsubscribe 
To search the archives -

Other related posts: