Looks like Oracle has a few more problems to worry about, other than its current court trials. A SQL bug allows any attacker to take over a database, application, or even execute SQL statements. This bug is a problem for customers that use Oracles Applications and E-Business Suite. It affects versions 115.1 to 11.5.8 of the E-Business Suite. However customers using 11.5.9 of Oracles E-Business Suite are not affected by this bug.
All Oracle Corp. Applications and most E-Business Suite customers are at high risk from multiple, critical SQL injection vulnerabilities. The vulnerabilities were uncovered by Stephen Kost from the security firm Integrigy Corp. An alert put out by Integrigy last week described the flaw as being exploitable by a remote user who can send a specially crafted URL to a Web server via a browser.
The risk level for the flaw is critical. Vulnerable versions include 11.5.1 through 11.5.8 of E-Business Suite. Release 11.5.9 is unaffected. Also at risk are both supported releases of Oracle Applications: 11.0 and 11i. All platforms are affected. According to Integrigy's alert, all customers are at risk, since Oracle Applications 11i installs code for all product modules. According to an advisory sent out by Oracle (click here for a .PDF of the advisory), risk to exposure is high, since the flaw can be exploited by any user with a browser and the knowledge of how to exploit the flaw.
News source: eWeek
