-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2021.0031
                 Oracle Supply Chain Critical Patch Update
                              21 January 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Oracle Agile Engineering Data Management
                      Oracle Agile PLM
                      Oracle Agile Product Lifecycle Management for Process
                      Oracle Complex Maintenance
                      Oracle Configurator
                      Oracle Transportation Management
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                      Modify Arbitrary Files          -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2021-2104 CVE-2021-2103 CVE-2021-2102
                      CVE-2021-2080 CVE-2021-2079 CVE-2021-2078
                      CVE-2020-14195 CVE-2020-9281 CVE-2019-17563
                      CVE-2019-11358  
Member content until: Saturday, February 20 2021
Reference:            ASB-2021.0024
                      ASB-2021.0023
                      ASB-2020.0186
                      ASB-2019.0199
                      ESB-2020.4452
                      ESB-2019.1360

OVERVIEW

        Multiple vulnerabilities have been identified in :
         o Oracle Agile Engineering Data Management, version 6.2.1.0
         o Oracle Agile PLM, versions 9.3.5, 9.3.6
         o Oracle Agile Product Lifecycle Management for Process, version
           6.1
         o Oracle Complex Maintenance, Repair, and Overhaul, versions
           11.5.10, 12.1, 12.2
         o Oracle Configurator, versions 12.1, 12.2
         o Oracle Transportation Management, version 1.4.3
        [1]


IMPACT

        The vendor has provided the following information regarding the
        vulnerabilities:
        
        "This Critical Patch Update contains 11 new security patches for
        Oracle Supply Chain. All of these vulnerabilities may be remotely
        exploitable without authentication, i.e., may be exploited over a
        network without requiring user credentials." [1]
        
        CVE-2021-2102
          8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
        Supported versions that are affected are 11.5.10, 12.1 and 12.2.
        Easily exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Complex Maintenance,
        Repair, and Overhaul. Successful attacks require human interaction
        from a person other than the attacker and while the vulnerability is
        in Oracle Complex Maintenance, Repair, and Overhaul, attacks may
        significantly impact additional products. Successful attacks of this
        vulnerability can result in unauthorized access to critical data or
        complete access to all Oracle Complex Maintenance, Repair, and
        Overhaul accessible data as well as unauthorized update, insert or
        delete access to some of Oracle Complex Maintenance, Repair, and
        Overhaul accessible data.
         Affects:
         o Oracle Complex Maintenance, Repair, and Overhaul 11.5.10, 12.1,
           12.2
        
        CVE-2021-2103
          8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
        Supported versions that are affected are 11.5.10, 12.1 and 12.2.
        Easily exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Complex Maintenance,
        Repair, and Overhaul. Successful attacks require human interaction
        from a person other than the attacker and while the vulnerability is
        in Oracle Complex Maintenance, Repair, and Overhaul, attacks may
        significantly impact additional products. Successful attacks of this
        vulnerability can result in unauthorized access to critical data or
        complete access to all Oracle Complex Maintenance, Repair, and
        Overhaul accessible data as well as unauthorized update, insert or
        delete access to some of Oracle Complex Maintenance, Repair, and
        Overhaul accessible data.
         Affects:
         o Oracle Complex Maintenance, Repair, and Overhaul 11.5.10, 12.1,
           12.2
        
        CVE-2021-2104
          8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
        Supported versions that are affected are 11.5.10, 12.1 and 12.2.
        Easily exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Complex Maintenance,
        Repair, and Overhaul. Successful attacks require human interaction
        from a person other than the attacker and while the vulnerability is
        in Oracle Complex Maintenance, Repair, and Overhaul, attacks may
        significantly impact additional products. Successful attacks of this
        vulnerability can result in unauthorized access to critical data or
        complete access to all Oracle Complex Maintenance, Repair, and
        Overhaul accessible data as well as unauthorized update, insert or
        delete access to some of Oracle Complex Maintenance, Repair, and
        Overhaul accessible data.
         Affects:
         o Oracle Complex Maintenance, Repair, and Overhaul 11.5.10, 12.1,
           12.2
        
        CVE-2021-2078
          8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
        Supported versions that are affected are 12.1 and 12.2. Easily
        exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Configurator. Successful
        attacks require human interaction from a person other than the
        attacker and while the vulnerability is in Oracle Configurator,
        attacks may significantly impact additional products. Successful
        attacks of this vulnerability can result in unauthorized access to
        critical data or complete access to all Oracle Configurator
        accessible data as well as unauthorized update, insert or delete
        access to some of Oracle Configurator accessible data.
         Affects:
         o Oracle Configurator 12.1, 12.2
        
        CVE-2021-2079
          8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
        Supported versions that are affected are 12.1 and 12.2. Easily
        exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Configurator. Successful
        attacks require human interaction from a person other than the
        attacker and while the vulnerability is in Oracle Configurator,
        attacks may significantly impact additional products. Successful
        attacks of this vulnerability can result in unauthorized access to
        critical data or complete access to all Oracle Configurator
        accessible data as well as unauthorized update, insert or delete
        access to some of Oracle Configurator accessible data.
         Affects:
         o Oracle Configurator 12.1, 12.2
        
        CVE-2021-2080
          8.2 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
        Supported versions that are affected are 12.1 and 12.2. Easily
        exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Configurator. Successful
        attacks require human interaction from a person other than the
        attacker and while the vulnerability is in Oracle Configurator,
        attacks may significantly impact additional products. Successful
        attacks of this vulnerability can result in unauthorized access to
        critical data or complete access to all Oracle Configurator
        accessible data as well as unauthorized update, insert or delete
        access to some of Oracle Configurator accessible data.
         Affects:
         o Oracle Configurator 12.1, 12.2
        
        CVE-2020-14195
          8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
        The supported version that is affected is 9.3.6. Difficult to exploit
        vulnerability allows unauthenticated attacker with network access via
        HTTP to compromise Oracle Agile PLM. Successful attacks of this
        vulnerability can result in takeover of Oracle Agile PLM.
         Affects:
         o Oracle Agile PLM 9.3.6
        
        CVE-2019-17563
          7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
        The supported version that is affected is 6.2.1.0. Difficult to
        exploit vulnerability allows unauthenticated attacker with network
        access via HTTP to compromise Oracle Agile Engineering Data
        Management. Successful attacks require human interaction from a
        person other than the attacker. Successful attacks of this
        vulnerability can result in takeover of Oracle Agile Engineering Data
        Management.
         Affects:
         o Oracle Agile Engineering Data Management 6.2.1.0
        
        CVE-2020-9281
          6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
        Supported versions that are affected are 9.3.5 and 9.3.6. Easily
        exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Agile PLM. Successful
        attacks require human interaction from a person other than the
        attacker and while the vulnerability is in Oracle Agile PLM, attacks
        may significantly impact additional products. Successful attacks of
        this vulnerability can result in unauthorized update, insert or
        delete access to some of Oracle Agile PLM accessible data as well as
        unauthorized read access to a subset of Oracle Agile PLM accessible
        data.
         Affects:
         o Oracle Agile PLM 9.3.5, 9.3.6
        
        CVE-2019-11358
          6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
        The supported version that is affected is 6.1. Easily exploitable
        vulnerability allows unauthenticated attacker with network access via
        HTTP to compromise Oracle Agile Product Lifecycle Management for
        Process. Successful attacks require human interaction from a person
        other than the attacker and while the vulnerability is in Oracle
        Agile Product Lifecycle Management for Process, attacks may
        significantly impact additional products. Successful attacks of this
        vulnerability can result in unauthorized update, insert or delete
        access to some of Oracle Agile Product Lifecycle Management for
        Process accessible data as well as unauthorized read access to a
        subset of Oracle Agile Product Lifecycle Management for Process
        accessible data.
         Affects:
         o Oracle Agile Product Lifecycle Management for Process 6.1
         o Oracle Transportation Management 1.4.3


MITIGATION

        Oracle states:
        
        "Due to the threat posed by a successful attack, Oracle strongly
        recommends that customers apply CPU fixes as soon as possible. Until
        you apply the CPU fixes, it may be possible to reduce the risk of
        successful attack by blocking network protocols required by an
        attack. For attacks that require certain privileges or access to
        certain packages, removing the privileges or the ability to access
        the packages from users that do not need the privileges may help
        reduce the risk of successful attack. Both approaches may break
        application functionality, so Oracle strongly recommends that
        customers test changes on non-production systems. Neither approach
        should be considered a long-term solution as neither corrects the
        underlying problem." [1]


REFERENCES

        [1] Oracle Critical Patch Update Advisory - January 2021
            Oracle Critical Patch Update Advisory - January 2021
    https://www.oracle.com/security-alerts/cpujan2021.html

        [2] Text Form of Oracle Critical Patch Update - January 2021 Risk
            Matrices
            https://www.oracle.com/security-alerts/cpujan2021verbose.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYAjlKONLKJtyKPYoAQj9iQ//ajGhbGFdAZKB+sFFFXT2awXzd5qa7QHC
WxSPBFxjBSpSHesINV+ow8whIOdVrJhY6ZfBqr96SO17P1NablDCpWr9c+uxg+ae
1hn5/+7snpTplIIFofio3u/S66KO1VQgkl/iQQv8DW9HpZqqVgPG0cGnAKLhFFex
cEioGRX7iDC1y7bnvXfTQgtpT7HMqrVj4SUOsZVzua8mnHHiZbhJ5Jb6a7NGoZzM
vnxdTgi9s0lfFes5wOB1nPufhaOg2ySBTfQaSOGZrygpFVC4IOuQr6OHusj3m7PY
fFc3TFfpTWHQ16Bb8IVErAKX4uGUh6mTObBnSKs4E8WOO4QbdjVWTx9PJcz647jh
ZrgYSR8yWrXMBtE3ibxGFi06oIair6NppTD06G44ENFjYfgAVZt27HgaQXGWAvWr
ccM7Vwvp2oVb8V4foHhX5INorD4YA3/p1P3zmehjykb+/GtPzITCkQQFuy0D64ii
ebhipuav7z0vgazqt4EIOIaMyce7B8eapaH/GQIJbr7aD1Ve7H26CBBq8pSmNSf+
zrwa0VvPG61btC/iIyAHQ6nVmNV83Q70cwUSOMSz71ZBLJEpOrx9T2fkCHEsbYki
7eA+IK90m/Zt2xBFIyeh/nhygEGPu1+VV/e4IlN8qQvdXSqHxn4JC79+c9t3s8mW
Me8HswJYdDk=
=3gcq
-----END PGP SIGNATURE-----