Oracle security alert #68 - advice?

I'd like to apply the patch for Oracle Security Alert #68 <http://metalink.oracle.com/metalink/plsql/showdoc?db=NOT&id=281188.1.>

I'm running Oracle 9.2.0.3 on Windows 2003. But the patch is only for v 9.2.0.4 - the FAQ says I should upgrade to 9.2.0.4 before applying the patch. What's the consensus about the best way to proceed - seems to me there are two candidate paths:

Path A

1. Shutdown the database
2. Do a cold backup
3. Apply 9.2.0.4 upgrade
4. Apply the security patch
5. Restart and test

Path B

1. Shutdown the database
2. Do a cold backup
3. Apply 9.2.0.4 upgrade
4. Restart and test
5. Shutdown the database
6. Do a cold backup
7. Apply the security patch
8. Restart and test

I'm going to use our development database as the guinea pig before applying it to production.

Thanks for the advice.

-- 
//-Walt
// 
//