Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2021.0082
Oracle Health Sciences Applications Critical Patch Update
21 April 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Oracle Health Sciences Empirica Signal
Oracle Health Sciences Information Manager
Oracle Healthcare Foundation
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-25649 CVE-2020-1945 CVE-2019-10086
Reference: ASB-2021.0077
ASB-2021.0066
ASB-2021.0029
ESB-2021.0334
ESB-2020.1680
ESB-2019.3134
OVERVIEW
Multiple vulnerabilities have been identified in :
o Oracle Health Sciences Empirica Signal, versions 9.0, 9.1
o Oracle Health Sciences Information Manager, versions
3.0.0-3.0.2
o Oracle Healthcare Foundation, versions 7.1.5, 7.2.2, 7.3.0,
7.3.1, 8.0.1
[1]
IMPACT
The vendor has provided the following information regarding the
vulnerabilities:
"This Critical Patch Update contains 3 new security patches for
Oracle Health Sciences Applications. All of these vulnerabilities may
be remotely exploitable without authentication, i.e., may be
exploited over a network without requiring user credentials." [1]
CVE-2020-1945
9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Supported versions that are affected are 3.0.0-3.0.2. Easily
exploitable vulnerability allows unauthenticated attacker with
network access via HTTP to compromise Oracle Health Sciences
Information Manager. Successful attacks of this vulnerability can
result in unauthorized creation, deletion or modification access to
critical data or all Oracle Health Sciences Information Manager
accessible data as well as unauthorized access to critical data or
complete access to all Oracle Health Sciences Information Manager
accessible data.
Affects:
o Oracle Health Sciences Information Manager 3.0.0-3.0.2
CVE-2020-25649
7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Supported versions that are affected are 9.0 and 9.1. Easily
exploitable vulnerability allows unauthenticated attacker with
network access via HTTP to compromise Oracle Health Sciences Empirica
Signal. Successful attacks of this vulnerability can result in
unauthorized creation, deletion or modification access to critical
data or all Oracle Health Sciences Empirica Signal accessible data.
Affects:
o Oracle Health Sciences Empirica Signal 9.0, 9.1
CVE-2019-10086
7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Supported versions that are affected are 7.1.5, 7.2.2, 7.3.0, 7.3.1
and 8.0.1. Easily exploitable vulnerability allows unauthenticated
attacker with network access via HTTP to compromise Oracle Healthcare
Foundation. Successful attacks of this vulnerability can result in
unauthorized update, insert or delete access to some of Oracle
Healthcare Foundation accessible data as well as unauthorized read
access to a subset of Oracle Healthcare Foundation accessible data
and unauthorized ability to cause a partial denial of service
(partial DOS) of Oracle Healthcare Foundation.
Affects:
o Oracle Healthcare Foundation 7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1
MITIGATION
Oracle states:
"Due to the threat posed by a successful attack, Oracle strongly
recommends that customers apply CPU fixes as soon as possible. Until
you apply the CPU fixes, it may be possible to reduce the risk of
successful attack by blocking network protocols required by an
attack. For attacks that require certain privileges or access to
certain packages, removing the privileges or the ability to access
the packages from users that do not need the privileges may help
reduce the risk of successful attack. Both approaches may break
application functionality, so Oracle strongly recommends that
customers test changes on non-production systems. Neither approach
should be considered a long-term solution as neither corrects the
underlying problem." [1]
REFERENCES
[1] Oracle Critical Patch Update Advisory - April 2021
https://www.oracle.com/security-alerts/cpuapr2021.html
[2] Text Form of Oracle Critical Patch Update - April 2021 Risk
Matrices
https://www.oracle.com/security-alerts/cpuapr2021verbose.html
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYH+/t+NLKJtyKPYoAQjMMw/8CL/UW8l4AoOq+iGz519CSkdS6TYpm38s
rS6wlzJdZtHSXN/jBCJN9j4RQQlOMEkbNvwfx8A8gz5KfESVmb172GNfDOk5O+mV
3qK6oNZIuQqyVdtv2mstoVM8SK3zRlIFMvxx+eAjJQ2EmlkPqQjYClxypdOK0wmn
HSnXjth77QFnHtJgy3ZrxUPbt3x70DvCjYTWqjepukKRqaspcMJCOoAtHSY/FSA9
eV1D2vc61m4eQqJ6uZHc64KiCh8iEDUPlp5MY89NAv3PLr/cNAGf0tx9TvN8dQ5y
8nT1ytK4Ee3PL8ChXkOEPlalHNApEIrQ+anavkcphiwO0Yq55T3KK6MPEGfTQUha
doUJWH+wrW/4Xlij8M9u1V0DpH5CMFvPiWgHPVCJvNl7A+KqIQ5p4o7dwiDSr9bl
X/qG1wk5hFjfZzusUz3egE3hhRQLpsGSF6SUt3XEGjZVzwBUi2apTYXj53+9lqzv
qGWGUKW40EfhGkcROQOMV2AyJPTnLYc+dLP0x5+dNYCIIumqErSxOHUJKn+YBBjR
jTp6yU1fsh9rkx3Tp84SKu+Oqhsgl8aKygvDg3pihVCMXmGTIYssxNjYAGoBeSvy
fh36agQEFhHIhoQr4gkylqf8zUEF7FxswrsssijAgHc0uJRQuz7b/Ns5NZqmAe7s
lB5SGaR5Nt8=
=Caq3
-----END PGP SIGNATURE-----