Oracle Security Blog

Oracle has decided not to release any security fixes in the July 2006 Critical Patch Update for Oracle E-Business Suite releases 11.5.1 - 11.5.6.  This may come as a shock to more than a few customers since the official Desupport date for 11.5.1 to 11.5.6 is July 31, 2006 (not July 18, 2006).

From E-Business
Suite Critical Patch Update July 2006 Note, MetaLink Note 372931.1 -

A frequent topic of discussion after any security assessment or review by auditors is the setting of O7_DICTIONARY_ACCESSIBILITY in Oracle Applications. 07_DICTIONARY_ACCESSIBILITY is a database initialization parameter that controls access to objects in the SYS schema.  It was originally intended to help with migrations from Oracle7 to newer versions where access to data dictionary objects is limited by default. From a pure security perspective, 07_DICTIONARY_ACCESSIBILITY should always be set to FALSE and is a very common security recommendations for Oracle Databases in general.

The APPLSYSPUB account is used by Oracle Applications to initially connect to the database and establish a session.  This account normally should have limited privileges.  However, during our audits the permissions assigned to APPLSYSPUB and PUBLIC are often a security risk and need to be corrected.

The Oracle Applications Security Blog will be an unique analysis and commentary on Oracle related security topics, especially related to Oracle Applications (the official product name is "Oracle E-Business Suite"). Since the Oracle Applications technology stack also includes most of the other Oracle products, I will also cover the Oracle Database, Oracle Application Server, and Oracle development products.

My goal is to use this as a forum for some experimentation into presenting security topics in a different way.