Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

     ESB-2005.0569 -- US-CERT Technical Cyber Security Alert TA05-194A
             Oracle Products Contain Multiple Vulnerabilities
                               19 July 2005


        AusCERT Security Bulletin Summary

Product:           Multiple Oracle Products (see below)
Publisher:         US-CERT
Impact:            Execute Arbitrary Code/Commands
                   Access Privileged Data
                   Denial of Service
Access:            Remote/Unauthenticated

Ref:               ESB-2005.0534

Original Bulletin: http://www.us-cert.gov/cas/techalerts/TA05-194A.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

                  National Cyber Alert System

         Technical Cyber Security Alert TA05-194A archive 

Oracle Products Contain Multiple Vulnerabilities

   Original release date: July 13, 2005
   Last revised: --
   Source: US-CERT

Systems Affected

   According to Oracle Critical Patch Update - July 2005:

     * Oracle Database 10g Release 1, versions,,

     * Oracle9i Database Server Release 2, versions,

     * Oracle9i Database Server Release 1, versions,, FIPS

     * Oracle8i Database Server Release 3, version

     * Oracle8 Database Release 8.0.6, version

     * Oracle Enterprise Manager Grid Control 10g, versions,

     * Oracle Enterprise Manager 10g Database Control, versions,,

     * Oracle Enterprise Manager Application Server Control, versions,

     * Oracle Application Server 10g (9.0.4), versions,

     * Oracle9i Application Server Release 2, versions,

     * Oracle9i Application Server Release 1, version

     * Oracle Collaboration Suite Release 2, versions,

     * Oracle E-Business Suite and Applications Release 11i, versions
       11.5.1 through 11.5.10 

     * Oracle E-Business Suite and Applications Release 11.0

     * Oracle Workflow, versions 11.5.1 through

     * Oracle Forms and Reports, versions,

     * Oracle JInitiator, versions 1.1.8, 1.3.1

     * Oracle Developer Suite, versions, 9.0.4,, 9.0.5,

     * Oracle Express Server, version


   Various Oracle products and components are affected by multiple
   vulnerabilities. The impacts of these vulnerabilities include
   unauthenticated, remote code execution, information disclosure, and
   denial of service.

I. Description

   Oracle released a Critical Patch Update in July 2005 that addresses
   more than forty vulnerabilities in different Oracle products and
   components. The Critical Patch Update provides information about which
   components are affected, what access and authorization are required,
   and how data confidentiality, integrity, and availability may be
   impacted. Public reports describe vulnerabilities related to insecure
   password and temporary file handling and SQL injection.

   US-CERT strongly recommends that sites running Oracle review the
   Critical Patch Update, apply patches, and take other mitigating action
   as appropriate.

   Oracle HTTP Server is based on the Apache HTTP Server. Some Oracle
   products include Java components from Sun Microsystems. According to
   Oracle, the July 2005 Critical Patch Update addresses previously
   disclosed vulnerabilities in Apache and Java. Oracle also notes that
   Oracle Database Client-only installations are not affected by
   vulnerabilities listed in the July 2005 Critical Patch Update.

   US-CERT is tracking all of these issues under VU#613562. As further
   information becomes available, we will publish individual
   Vulnerability Notes.

II. Impact

   The impacts of these vulnerabilities vary depending on product or
   component and configuration. Potential consequences include remote
   execution of arbitrary code or commands, information disclosure, and
   denial of service. An attacker who compromises an Oracle database may
   be able to gain access to sensitive information.

III. Solution

Apply a patch

   Apply the appropriate patches or upgrade as specified in the Oracle
   Critical Patch Update - July 2005. The update notes that some Oracle
   patches are cumulative while others are not:

     The Oracle Database Server, Enterprise Manager, and the Oracle
     Application Server patches in the Updates are cumulative; each
     successive Critical Patch Update contains the fixes from the
     previous Critical Patch Updates.
     E-Business Suite patches are not cumulative, so E-Business Suite
     customers should refer to previous Critical Patch Updates to
     identify previous fixes they wish to apply.
     Oracle Collaboration Suite patches are not cumulative, so Oracle
     Collaboration Suite customers should refer to previous Critical
     Patch Updates to identify previous fixes they wish to apply. 


   It may be possible to mitigate some vulnerabilities by disabling or
   removing unnecessary components, restricting network access, and
   restricting access to temporary files.

   Oracle Critical Patch Update - July 2005 suggests setting a TNS
   listner password to mitigate a vulnerability in Oracle Database Server

Appendix A. Vendor Information


   Please see Oracle Critical Patch Update - July 2005 and Critical Patch
   Updates and Security Alerts.

Appendix B. References

     * Critical Patch Update - July 2005-

     * Critical Patch Updates and Security Alerts -

     * Map of Public Vulnerability to Advisory/Alert -

     * US-CERT Vulnerability Note VU#613562 -

     * Oracle JDeveloper passes Plaintext Password -

     * Oracle JDeveloper Plaintext Passwords -

     * Oracle Forms Builder Password in Temp Files -

     * Oracle Forms Insecure Temporary File Handling -

     * Multiple High Risk Vulnerabilities in Oracle E-Business Suite 11i
       - <http://www.integrigy.com/alerts/OraCPU0705.htm>


   Information used in this document came from Red-Database-Security and
   Oracle. Oracle credits Qualys Inc., Application Security, Inc., Red
   Database Security GmbH, Integrigy, NGS Software, nCircle Network
   Security, and Rigel Kent Security.

   Feedback can be directed to US-CERT Technical Staff.

   Please send mail to cert@cert.org with the subject:

   "TA05-194A Feedback VU#613562"

   This document is available at


   Produced 2005 by US-CERT, a government organization. 

   Terms of use:


   Revision History

   July 13, 2005: Initial release
   Last updated July 13, 2005 


Version: GnuPG v1.2.1 (GNU/Linux)


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.

Comment: http://www.auscert.org.au/render.html?it=1967