[Full-disclosure] Oracle E-Business Suite Vulnerability Information April 2007

["Integrigy Alerts" <alerts@xxxxxxxxxxxxx>]

Integrigy has released additional information on the Oracle E-Business Suite
11i and R12 security vulnerabilities in the April 2007 Oracle Critical Patch
Update.  This analysis includes details (type, impact, etc.) regarding the
vulnerabilities, a review of the required patches, and advice on applying
the 6-10 required patches in a timely manner.

http://www.integrigy.com/Oracle_CPU_April_2007.pdf

Based on our discussions with clients, there seems to be continuing
confusion regarding the versions (i.e., patch sets) required to apply the
security patches.  Oracle's policy is simple - Oracle only supports the 2
most recent patch sets that have been released in the past 12 months for the
Oracle Database and Oracle Application Server.  There are some exceptions to
policy based on operating system support and other product dependencies.  To
highlight the differences between certified versions and versions supported
in the April 2007 CPU we have released the following -

http://www.integrigy.com/security-resources/analysis/Oracle-CPU-Support-Matr
ix-April-2007.pdf


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/