Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:9174
HistoryJul 14, 2005 - 12:00 a.m.

US-CERT Technical Cyber Security Alert TA05-194A -- Oracle Products Contain Multiple Vulnerabilities

2005-07-1400:00:00
vulners.com
19
JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

              National Cyber Alert System

     Technical Cyber Security Alert TA05-194A archive

Oracle Products Contain Multiple Vulnerabilities

Original release date: July 13, 2005
Last revised: –
Source: US-CERT

Systems Affected

According to Oracle Critical Patch Update - July 2005:

 * Oracle Database 10g Release 1, versions 10.1.0.2, 10.1.0.3,
   10.1.0.4

 * Oracle9i Database Server Release 2, versions 9.2.0.5, 9.2.0.6

 * Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5,
   9.0.1.5 FIPS

 * Oracle8i Database Server Release 3, version 8.1.7.4

 * Oracle8 Database Release 8.0.6, version 8.0.6.3

 * Oracle Enterprise Manager Grid Control 10g, versions 10.1.0.2,
   10.1.0.3

 * Oracle Enterprise Manager 10g Database Control, versions 10.1.0.2,
   10.1.0.3, 10.1.0.4

 * Oracle Enterprise Manager Application Server Control, versions
   9.0.4.0, 9.0.4.1

 * Oracle Application Server 10g (9.0.4), versions 9.0.4.0, 9.0.4.1

 * Oracle9i Application Server Release 2, versions 9.0.2.3, 9.0.3.1

 * Oracle9i Application Server Release 1, version 1.0.2.2

 * Oracle Collaboration Suite Release 2, versions 9.0.4.1, 9.0.4.2

 * Oracle E-Business Suite and Applications Release 11i, versions
   11.5.1 through 11.5.10 

 * Oracle E-Business Suite and Applications Release 11.0

 * Oracle Workflow, versions 11.5.1 through 11.5.9.5

 * Oracle Forms and Reports, versions 4.5.10.22, 6.0.8.25

 * Oracle JInitiator, versions 1.1.8, 1.3.1

 * Oracle Developer Suite, versions 9.0.2.3, 9.0.4, 9.0.4.1, 9.0.5,
   10.1.2

 * Oracle Express Server, version 6.3.4.0

Overview

Various Oracle products and components are affected by multiple
vulnerabilities. The impacts of these vulnerabilities include
unauthenticated, remote code execution, information disclosure, and
denial of service.

I. Description

Oracle released a Critical Patch Update in July 2005 that addresses
more than forty vulnerabilities in different Oracle products and
components. The Critical Patch Update provides information about which
components are affected, what access and authorization are required,
and how data confidentiality, integrity, and availability may be
impacted. Public reports describe vulnerabilities related to insecure
password and temporary file handling and SQL injection.

US-CERT strongly recommends that sites running Oracle review the
Critical Patch Update, apply patches, and take other mitigating action
as appropriate.

Oracle HTTP Server is based on the Apache HTTP Server. Some Oracle
products include Java components from Sun Microsystems. According to
Oracle, the July 2005 Critical Patch Update addresses previously
disclosed vulnerabilities in Apache and Java. Oracle also notes that
Oracle Database Client-only installations are not affected by
vulnerabilities listed in the July 2005 Critical Patch Update.

US-CERT is tracking all of these issues under VU#613562. As further
information becomes available, we will publish individual
Vulnerability Notes.

II. Impact

The impacts of these vulnerabilities vary depending on product or
component and configuration. Potential consequences include remote
execution of arbitrary code or commands, information disclosure, and
denial of service. An attacker who compromises an Oracle database may
be able to gain access to sensitive information.

III. Solution

Apply a patch

Apply the appropriate patches or upgrade as specified in the Oracle
Critical Patch Update - July 2005. The update notes that some Oracle
patches are cumulative while others are not:

 The Oracle Database Server, Enterprise Manager, and the Oracle
 Application Server patches in the Updates are cumulative; each
 successive Critical Patch Update contains the fixes from the
 previous Critical Patch Updates.
 E-Business Suite patches are not cumulative, so E-Business Suite
 customers should refer to previous Critical Patch Updates to
 identify previous fixes they wish to apply.
 Oracle Collaboration Suite patches are not cumulative, so Oracle
 Collaboration Suite customers should refer to previous Critical
 Patch Updates to identify previous fixes they wish to apply.

Workarounds

It may be possible to mitigate some vulnerabilities by disabling or
removing unnecessary components, restricting network access, and
restricting access to temporary files.

Oracle Critical Patch Update - July 2005 suggests setting a TNS
listner password to mitigate a vulnerability in Oracle Database Server
(DB08).

Appendix A. Vendor Information

Oracle

Please see Oracle Critical Patch Update - July 2005 and Critical Patch
Updates and Security Alerts.

Appendix B. References

 * Critical Patch Update - July 2005-
   <http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.h
   tml>

 * Critical Patch Updates and Security Alerts -
   <http://www.oracle.com/technology/deploy/security/alerts.htm>

 * Map of Public Vulnerability to Advisory/Alert -
   <http://www.oracle.com/technology/deploy/security/pdf/public_vuln_
   to_advisory_mapping.html>

 * US-CERT Vulnerability Note VU#613562 -
   <http://www.kb.cert.org/vuls/id/613562>

 * Oracle JDeveloper passes Plaintext Password -
   <http://www.red-database-security.com/advisory/oracle_jdeveloper_p
   asses_plaintext_password.html>

 * Oracle JDeveloper Plaintext Passwords -
   <http://www.red-database-security.com/advisory/oracle_jdeveloper_p
   laintext_password.html>

 * Oracle Forms Builder Password in Temp Files -
   <http://www.red-database-security.com/advisory/oracle_formsbuilder
   _temp_file_issue.html>

 * Oracle Forms Insecure Temporary File Handling -
   <http://www.red-database-security.com/advisory/oracle_forms_unsecu
   re_temp_file_handling.html>

 * Multiple High Risk Vulnerabilities in Oracle E-Business Suite 11i
   - <http://www.integrigy.com/alerts/OraCPU0705.htm>

Information used in this document came from Red-Database-Security and
Oracle. Oracle credits Qualys Inc., Application Security, Inc., Red
Database Security GmbH, Integrigy, NGS Software, nCircle Network
Security, and Rigel Kent Security.

Feedback can be directed to US-CERT Technical Staff.

Please send mail to [email protected] with the subject:

"TA05-194A Feedback VU#613562"

This document is available at

<http://www.us-cert.gov/cas/techalerts/TA05-194A.html&gt;

Produced 2005 by US-CERT, a government organization.

Terms of use:

<http://www.us-cert.gov/legal.html&gt;

Revision History

July 13, 2005: Initial release

Last updated July 13, 2005

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQtV4cxhoSezw4YfQAQLYkgf+I48YLEeutCHbzFWvz77pu+m4hs6Gltzf
Nd6nhkzdfsU6arAqb1hXG5p7GEJ1adJB8Nz+df12MKxMVJAWfW6xjlEhlsHnuVJM
hLThHyI166U34qbQt0SWKwlg1aKonAuP3p6XY16LCm7Vbq9G1HQgDGpK02LHbf/8
rWs2bUNqhPy7iz6wRwrF0w7CxJxI6+m6nfVnASwVknDCClz0bRyyw5oT6GUTeXOa
X+DlnbMj7BLv08gJve/f5pSf7dQIZObHo6jBEV0/99ZW9P6h4dYAtLznOUYAd+5Q
8aIzfiK5RVe5uUFJsuTu+4dTV1lXfTF5eKEWNu5PWQHNT1NTXWIfCA==
=HYcV
-----END PGP SIGNATURE-----

JSON