-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2019.0030
          Multiple vulnerabilities have been identified in Oracle
                        Supply Chain Products Suite
                              16 January 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Oracle Agile Engineering Data Management
                      Oracle Agile PLM
                      Oracle Agile Product Lifecycle Management for Process
                      Oracle Transportation Management
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                      Modify Arbitrary Files          -- Remote with User Interaction
                      Delete Arbitrary Files          -- Remote with User Interaction
                      Denial of Service               -- Remote/Unauthenticated      
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2019-2487 CVE-2018-0732 CVE-2017-14735
                      CVE-2015-9251 CVE-2015-8965 
Member content until: Friday, February 15 2019
Reference:            ASB-2019.0027
                      ASB-2019.0026
                      ASB-2019.0025
                      ASB-2019.0023
                      ESB-2018.1870
                      ESB-2018.1758

OVERVIEW

        Multiple vulnerabilities have been identified in :
         o Oracle Agile Engineering Data Management, versions 6.1.3,
           6.2.0, 6.2.1
         o Oracle Agile PLM, versions 9.3.3, 9.3.4, 9.3.5, 9.3.6
         o Oracle Agile Product Lifecycle Management for Process, versions
           6.2.0.0, 6.2.1.0, 6.2.2.0, 6.2.3.0, 6.2.3.1
         o Oracle Transportation Management, versions 6.3.7, 6.4.1, 6.4.2,
           6.4.3
        [1]


IMPACT

        The vendor has provided the following information regarding the
        vulnerabilities:
        
        "This Critical Patch Update contains 5 new security fixes for the
        Oracle Supply Chain Products Suite. 4 of these vulnerabilities may
        be remotely exploitable without authentication, i.e., may be
        exploited over a network without requiring user credentials." [1]
        
        "CVE-2015-8965
        
        9.8
        
        AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
        
        Supported versions that are affected are 9.3.3, 9.3.4, 9.3.5 and
        9.3.6. Easily exploitable vulnerability allows unauthenticated
        attacker with network access via HTTP to compromise Oracle Agile PLM.
        Successful attacks of this vulnerability can result in takeover of
        Oracle Agile PLM.
        
        CVE-2018-0732
        
        7.5
        
        AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
        
        Supported versions that are affected are 6.1.3, 6.2.0 and  6.2.1.
        Easily exploitable vulnerability allows unauthenticated attacker with
        network access via HTTPS to compromise Oracle Agile Engineering Data
        Management. Successful attacks of this vulnerability can result in
        unauthorized ability to cause a hang or frequently repeatable crash
        (complete DOS) of Oracle Agile Engineering Data Management.
        
        CVE-2019-2487
        
        6.5
        
        AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
        
        Supported versions that are affected are 6.3.7, 6.4.1, 6.4.2 and
        6.4.3. Easily exploitable vulnerability allows low privileged
        attacker with network access via HTTP to compromise Oracle
        Transportation Management.  Successful attacks of this vulnerability
        can result in  unauthorized creation, deletion or modification access
        to critical data or all Oracle Transportation Management accessible
        data.
        
        CVE-2017-14735
        
        6.1
        
        AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
        
        Supported versions that are affected are 9.3.4 and  9.3.5. Easily
        exploitable vulnerability allows unauthenticated attacker with
        network access via HTTP to compromise Oracle Agile PLM.  Successful
        attacks require human interaction from a person other than the
        attacker and while the vulnerability is in Oracle Agile PLM, attacks
        may significantly impact additional products. Successful attacks of
        this vulnerability can result in unauthorized update, insert or
        delete access to some of Oracle Agile PLM accessible data as well as
        unauthorized read access to a subset of Oracle Agile PLM accessible
        data.
        
        CVE-2015-9251
        
        6.1
        
        AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
        
        Supported versions that are affected are 6.2.0.0, 6.2.1.0, 6.2.2.0,
        6.2.3.0 and  6.2.3.1. Easily exploitable vulnerability allows
        unauthenticated attacker with network access via HTTP to compromise
        Oracle Agile Product Lifecycle Management for Process. Successful
        attacks require human interaction from a person other than the
        attacker and while the vulnerability is in Oracle Agile Product
        Lifecycle Management for Process, attacks may significantly impact
        additional products. Successful attacks of this vulnerability can
        result in unauthorized update, insert or delete access to some of
        Oracle Agile Product Lifecycle Management for Process accessible data
        as well as  unauthorized read access to a subset of Oracle Agile
        Product Lifecycle Management for Process accessible data." [2]


MITIGATION

        Oracle states:
        
        "Due to the threat posed by a successful attack, Oracle strongly
        recommends that customers apply CPU fixes as soon as possible. Until
        you apply the CPU fixes, it may be possible to reduce the risk of
        successful attack by blocking network protocols required by an
        attack. For attacks that require certain privileges or access to
        certain packages, removing the privileges or the ability to access
        the packages from users that do not need the privileges may help
        reduce the risk of successful attack. Both approaches may break
        application functionality, so Oracle strongly recommends that
        customers test changes on non-production systems. Neither approach
        should be considered a long-term solution as neither corrects the
        underlying problem." [1]


REFERENCES

        [1] Oracle Critical Patch Update Advisory - January 2019
            https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

        [2] Text Form of Oracle Critical Patch Update - January 2019 Risk
            Matrices
            https://www.oracle.com/technetwork/security-advisory/cpujan2019verbose-5072807.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXD6+KGaOgq3Tt24GAQh9yhAAqvo+EiYhAyC2Yfp/iXj9aiqRW9JO1DzM
/XXKO2k6l7popY5z3cGKEB+RvyiYJcMde8WS0P/7jrLRtA7ct4DWOk3Dp+KfTnbp
OF2yuSreydT6HP+yUJn/rISfwwor4yKl4HYA2vnURUsNcpp4JwUWS7Ex1ZwNmbol
5ML9tUliSs6G9cRHcCQ6hquMu3DhKhiTmz0FWA+vv2YTJlaZHAi80XX6wnh48W1u
nfXch8tqT4B3Mg8QOa7i2E5sRkd2Q2yKbhZpA7VMvXF5Kj5Kpd8jqWlACymcNI3f
1E9BPZvhgIpvm4yXuT8ByeRYOZtz2lVcKiPDmT44o6u/N9teVCZDmnIRD4HE8JeI
UazbcpT2XvhHYMaQjZxlU/EuwRhKzV4gTgXpL++k7YTtqX9EtsFm2I1tTqSGqNHR
JpPXZ+Wyl3GCZxDZNztT0kipIvzjw7koTIJp9i8ptOdWI+I1xbhhWY4DBzv/PAkx
04jImSnxzPbbjc0bbnRn7YEQzO3fiyhvcFG6nKjdPo8ih2RvCWGSnC/jlPX1Wqwp
ZBGppp2bVR0dIJON+J9RFyGyiE5hxisp3Qa65P5ejDpsVqPWqeGdEOBcqHji3bwf
Mf72V7ovB2py5wBlVUbNHfSSYI8ZYsnbv0JJXRZH00e7pAmrHGH5Ar4Y961XEr/O
LeaTIu2UuUY=
=ht2k
-----END PGP SIGNATURE-----