[NEWS] Oracle Products Multiple Vulnerabilities (TA05-194A)

From: SecuriTeam (support_at_securiteam.com)
Date: 07/21/05

  • Next message: SecuriTeam: "[UNIX] Veritas NetBackup TIME_STAMP DoS"
    To: list@securiteam.com
    Date: 21 Jul 2005 13:52:24 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Oracle Products Multiple Vulnerabilities (TA05-194A)
    ------------------------------------------------------------------------

    SUMMARY

    Various <http://www.oracle.com/> Oracle products and components are
    affected by multiple vulnerabilities. The impacts of these vulnerabilities
    include unauthenticated, remote code execution, information disclosure,
    and denial of service.

    DETAILS

    Vulnerable Systems:
     * Oracle Database 10g Release 1, versions 10.1.0.2, 10.1.0.3, 10.1.0.4
     * Oracle9i Database Server Release 2, versions 9.2.0.5, 9.2.0.6
     * Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5, 9.0.1.5
    FIPS
     * Oracle8i Database Server Release 3, version 8.1.7.4
     * Oracle8 Database Release 8.0.6, version 8.0.6.3
     * Oracle Enterprise Manager Grid Control 10g, versions 10.1.0.2, 10.1.0.3
     * Oracle Enterprise Manager 10g Database Control, versions 10.1.0.2,
    10.1.0.3, 10.1.0.4
     * Oracle Enterprise Manager Application Server Control, versions 9.0.4.0,
    9.0.4.1
     * Oracle Application Server 10g (9.0.4), versions 9.0.4.0, 9.0.4.1
     * Oracle9i Application Server Release 2, versions 9.0.2.3, 9.0.3.1
     * Oracle9i Application Server Release 1, version 1.0.2.2
     * Oracle Collaboration Suite Release 2, versions 9.0.4.1, 9.0.4.2
     * Oracle E-Business Suite and Applications Release 11i, versions 11.5.1
    through 11.5.10
     * Oracle E-Business Suite and Applications Release 11.0
     * Oracle Workflow, versions 11.5.1 through 11.5.9.5
     * Oracle Forms and Reports, versions 4.5.10.22, 6.0.8.25
     * Oracle JInitiator, versions 1.1.8, 1.3.1
     * Oracle Developer Suite, versions 9.0.2.3, 9.0.4, 9.0.4.1, 9.0.5, 10.1.2
     * Oracle Express Server, version 6.3.4.0

    Oracle released a
    <http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html>
    Critical Patch Update in July 2005 that addresses more than forty
    vulnerabilities in different Oracle products and components. The Critical
    Patch Update provides information about which components are affected,
    what access and authorization are required, and how data confidentiality,
    integrity, and availability may be impacted. Public reports describe
    vulnerabilities related to insecure password and temporary file handling
    and SQL injection.

    Oracle HTTP Server is based on the Apache HTTP Server. Some Oracle
    products include Java components from Sun Microsystems. According to
    <http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.html> Oracle, the July 2005 Critical Patch Update addresses previously disclosed vulnerabilities in Apache and Java. Oracle also notes that Oracle Database Client-only installations are not affected by vulnerabilities listed in the July 2005 Critical Patch Update.

    Solution:
    Apply the appropriate patches or upgrade as specified in the Oracle
    <http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html>
    Critical Patch Update - July 2005. The update notes that some Oracle
    patches are cumulative while others are not:

        The Oracle Database Server, Enterprise Manager, and the Oracle
    Application Server patches in the Updates are cumulative; each successive
    Critical Patch Update contains the fixes from the previous Critical Patch
    Updates.

        E-Business Suite patches are not cumulative, so E-Business Suite
    customers should refer to previous Critical Patch Updates to identify
    previous fixes they wish to apply.

        Oracle Collaboration Suite patches are not cumulative, so Oracle
    Collaboration Suite customers should refer to previous Critical Patch
    Updates to identify previous fixes they wish to apply.

    Workarounds:
    It may be possible to mitigate some vulnerabilities by disabling or
    removing unnecessary components, restricting network access, and
    restricting access to temporary files.
    Oracle
    <http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html>
    Critical Patch Update - July 2005 suggests setting a TNS listner password
    to mitigate a vulnerability in Oracle Database Server (DB08).

    References:
     <US-CERT Technical Cyber Security Alert TA05-194A> US-CERT Technical
    Cyber Security Alert TA05-194A
     <http://www.kb.cert.org/vuls/id/613562> US-CERT Vulnerability Note
    VU#613562
     <http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html>
    Oracle Critical Patch Update - July 2005
     <http://www.oracle.com/technology/deploy/security/alerts.htm> Oracle
    Critical Patch Updates and Security Alerts

    ADDITIONAL INFORMATION

    The information has been provided by US-CERT.
    The original article can be found at:
    <http://www.us-cert.gov/cas/techalerts/TA05-194A.html>
    http://www.us-cert.gov/cas/techalerts/TA05-194A.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[UNIX] Veritas NetBackup TIME_STAMP DoS"

    Relevant Pages