Harry Johnston has reported a security issue in Oracle Database Server 10g, which potentially can be exploited by malicious people to compromise a user's system.

The problem is that the binary and Java Runtime directories are improperly added to the front of the system path when installing the OraClient 10g component, which contains old vulnerable versions of Info-ZIP's zip (version 2.1) and unzip (version 5.32), and Sun Java JRE (version 1.4.2_03).

For more information:
SA8781
SA9784
SA10051
SA11570
SA12206
SA13094
SA13142
SA13271
SA14640
SA15671

The security issue has been reported in version 10.1.0.2.0. Other versions may also be affected.

Solution
Don't use the included zip, unzip, and Java utilities.
Further details available to Secunia VIM customers

Provided and/or discovered by
Harry Johnston, University of Waikato, New Zealand

Changelog
Further details available to Secunia VIM customers

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers