Published:
19 July 2005
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2005.0569 -- US-CERT Technical Cyber Security Alert TA05-194A Oracle Products Contain Multiple Vulnerabilities 19 July 2005 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Multiple Oracle Products (see below) Publisher: US-CERT Impact: Execute Arbitrary Code/Commands Access Privileged Data Denial of Service Access: Remote/Unauthenticated Ref: ESB-2005.0534 Original Bulletin: http://www.us-cert.gov/cas/techalerts/TA05-194A.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA05-194A archive Oracle Products Contain Multiple Vulnerabilities Original release date: July 13, 2005 Last revised: -- Source: US-CERT Systems Affected According to Oracle Critical Patch Update - July 2005: * Oracle Database 10g Release 1, versions 10.1.0.2, 10.1.0.3, 10.1.0.4 * Oracle9i Database Server Release 2, versions 9.2.0.5, 9.2.0.6 * Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5, 9.0.1.5 FIPS * Oracle8i Database Server Release 3, version 8.1.7.4 * Oracle8 Database Release 8.0.6, version 8.0.6.3 * Oracle Enterprise Manager Grid Control 10g, versions 10.1.0.2, 10.1.0.3 * Oracle Enterprise Manager 10g Database Control, versions 10.1.0.2, 10.1.0.3, 10.1.0.4 * Oracle Enterprise Manager Application Server Control, versions 9.0.4.0, 9.0.4.1 * Oracle Application Server 10g (9.0.4), versions 9.0.4.0, 9.0.4.1 * Oracle9i Application Server Release 2, versions 9.0.2.3, 9.0.3.1 * Oracle9i Application Server Release 1, version 1.0.2.2 * Oracle Collaboration Suite Release 2, versions 9.0.4.1, 9.0.4.2 * Oracle E-Business Suite and Applications Release 11i, versions 11.5.1 through 11.5.10 * Oracle E-Business Suite and Applications Release 11.0 * Oracle Workflow, versions 11.5.1 through 11.5.9.5 * Oracle Forms and Reports, versions 4.5.10.22, 6.0.8.25 * Oracle JInitiator, versions 1.1.8, 1.3.1 * Oracle Developer Suite, versions 9.0.2.3, 9.0.4, 9.0.4.1, 9.0.5, 10.1.2 * Oracle Express Server, version 6.3.4.0 Overview Various Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include unauthenticated, remote code execution, information disclosure, and denial of service. I. Description Oracle released a Critical Patch Update in July 2005 that addresses more than forty vulnerabilities in different Oracle products and components. The Critical Patch Update provides information about which components are affected, what access and authorization are required, and how data confidentiality, integrity, and availability may be impacted. Public reports describe vulnerabilities related to insecure password and temporary file handling and SQL injection. US-CERT strongly recommends that sites running Oracle review the Critical Patch Update, apply patches, and take other mitigating action as appropriate. Oracle HTTP Server is based on the Apache HTTP Server. Some Oracle products include Java components from Sun Microsystems. According to Oracle, the July 2005 Critical Patch Update addresses previously disclosed vulnerabilities in Apache and Java. Oracle also notes that Oracle Database Client-only installations are not affected by vulnerabilities listed in the July 2005 Critical Patch Update. US-CERT is tracking all of these issues under VU#613562. As further information becomes available, we will publish individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary depending on product or component and configuration. Potential consequences include remote execution of arbitrary code or commands, information disclosure, and denial of service. An attacker who compromises an Oracle database may be able to gain access to sensitive information. III. Solution Apply a patch Apply the appropriate patches or upgrade as specified in the Oracle Critical Patch Update - July 2005. The update notes that some Oracle patches are cumulative while others are not: The Oracle Database Server, Enterprise Manager, and the Oracle Application Server patches in the Updates are cumulative; each successive Critical Patch Update contains the fixes from the previous Critical Patch Updates. E-Business Suite patches are not cumulative, so E-Business Suite customers should refer to previous Critical Patch Updates to identify previous fixes they wish to apply. Oracle Collaboration Suite patches are not cumulative, so Oracle Collaboration Suite customers should refer to previous Critical Patch Updates to identify previous fixes they wish to apply. Workarounds It may be possible to mitigate some vulnerabilities by disabling or removing unnecessary components, restricting network access, and restricting access to temporary files. Oracle Critical Patch Update - July 2005 suggests setting a TNS listner password to mitigate a vulnerability in Oracle Database Server (DB08). Appendix A. Vendor Information Oracle Please see Oracle Critical Patch Update - July 2005 and Critical Patch Updates and Security Alerts. Appendix B. References * Critical Patch Update - July 2005- <http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.h tml> * Critical Patch Updates and Security Alerts - <http://www.oracle.com/technology/deploy/security/alerts.htm> * Map of Public Vulnerability to Advisory/Alert - <http://www.oracle.com/technology/deploy/security/pdf/public_vuln_ to_advisory_mapping.html> * US-CERT Vulnerability Note VU#613562 - <http://www.kb.cert.org/vuls/id/613562> * Oracle JDeveloper passes Plaintext Password - <http://www.red-database-security.com/advisory/oracle_jdeveloper_p asses_plaintext_password.html> * Oracle JDeveloper Plaintext Passwords - <http://www.red-database-security.com/advisory/oracle_jdeveloper_p laintext_password.html> * Oracle Forms Builder Password in Temp Files - <http://www.red-database-security.com/advisory/oracle_formsbuilder _temp_file_issue.html> * Oracle Forms Insecure Temporary File Handling - <http://www.red-database-security.com/advisory/oracle_forms_unsecu re_temp_file_handling.html> * Multiple High Risk Vulnerabilities in Oracle E-Business Suite 11i - <http://www.integrigy.com/alerts/OraCPU0705.htm> _________________________________________________________________ Information used in this document came from Red-Database-Security and Oracle. Oracle credits Qualys Inc., Application Security, Inc., Red Database Security GmbH, Integrigy, NGS Software, nCircle Network Security, and Rigel Kent Security. _________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send mail to cert@cert.org with the subject: "TA05-194A Feedback VU#613562" _________________________________________________________________ This document is available at <http://www.us-cert.gov/cas/techalerts/TA05-194A.html> _________________________________________________________________ Produced 2005 by US-CERT, a government organization. _________________________________________________________________ Terms of use: <http://www.us-cert.gov/legal.html> _________________________________________________________________ Revision History July 13, 2005: Initial release Last updated July 13, 2005 - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQtV4cxhoSezw4YfQAQLYkgf+I48YLEeutCHbzFWvz77pu+m4hs6Gltzf Nd6nhkzdfsU6arAqb1hXG5p7GEJ1adJB8Nz+df12MKxMVJAWfW6xjlEhlsHnuVJM hLThHyI166U34qbQt0SWKwlg1aKonAuP3p6XY16LCm7Vbq9G1HQgDGpK02LHbf/8 rWs2bUNqhPy7iz6wRwrF0w7CxJxI6+m6nfVnASwVknDCClz0bRyyw5oT6GUTeXOa X+DlnbMj7BLv08gJve/f5pSf7dQIZObHo6jBEV0/99ZW9P6h4dYAtLznOUYAd+5Q 8aIzfiK5RVe5uUFJsuTu+4dTV1lXfTF5eKEWNu5PWQHNT1NTXWIfCA== =HYcV - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBQtxlBih9+71yA2DNAQLHigP+L6OQnhJuaiIWtgBEJR/FQX34dvPLGQhp 98hNw4gCjjr1beAv/15WdzSzq58ami9XE/FCBj7yl/dp0wpaA7hPvKlyaAphT3Qy kOXw8c1Bi0dovAVVBVZi/dUsxjLwcXUByf96WCLvQV+k3JBmDeA2V71h5B/kkZj6 HH1b+tSPBhA= =9bdI -----END PGP SIGNATURE-----