|
|
>> Oracle and BEA Products Multiple Code Execution Vulnerabilities
|
Multiple vulnerabilities have been identified in various Oracle and BEA products, which could be exploited by remote or local attackers to cause a denial of service, read and manipulate certain data, disclose sensitive information, conduct SQL injection attacks, bypass security restrictions, or execute arbitrary commands.
These issues are caused by errors in the Data Mining, OLAP, Data Capture, Spatial, Workspace Manager, Upgrade, AS, Core RDBMS, Oracle Portal, Reports Developer, JDeveloper, Discoverer Administrator, Discoverer Desktop, Applications Technology Stack, iSupplier Portal, iStore, Applications Framework, PeopleTools, PeopleSoft Enterprise Portal, JDE EnterpriseOne Business Service Server, WebLogic Server, Plugins for Apache, and Workshop components.
Affected Products
Oracle Database 11g version 11.1.0.6
Oracle Database 10g Release 2 version 10.2.0.2
Oracle Database 10g Release 2 version 10.2.0.3
Oracle Database 10g Release 2 version 10.2.0.4
Oracle Database 10g version 10.1.0.5
Oracle Database 9i Release 2 version 9.2.0.8
Oracle Database 9i Release 2 version 9.2.0.8DV
Oracle Application Server 10g Release 3 (10.1.3) version 10.1.3.3.0
Oracle Application Server 10g Release 3 (10.1.3) version 10.1.3.4.0
Oracle Application Server 10g Release 2 (10.1.2) version 10.1.2.2.0
Oracle Application Server 10g Release 2 (10.1.2) version 10.1.2.3.0
Oracle Application Server 10g (9.0.4) version 9.0.4.3
Oracle E-Business Suite Release 12 version 12.0.4
Oracle E-Business Suite Release 11i version 11.5.10.2
Oracle PeopleSoft Enterprise PeopleTools version 8.48.18
Oracle PeopleSoft Enterprise PeopleTools version 8.49.14
Oracle PeopleSoft Enterprise Portal version 8.9
Oracle PeopleSoft Enterprise Portal version 9.0
Oracle JD Edwards EnterpriseOne Tools version 8.97
Oracle JD Edwards EnterpriseOne Tools version 8.98
Oracle WebLogic Server (formerly BEA WebLogic Server) versions 10.0 through MP1
Oracle WebLogic Server (formerly BEA WebLogic Server) version 10.3 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) version 9.0 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) version 9.1 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) versions 9.2 through MP3
Oracle WebLogic Server (formerly BEA WebLogic Server) versions 8.1 through SP6
Oracle WebLogic Server (formerly BEA WebLogic Server) versions 7.0 through SP7
Oracle WebLogic Server (formerly BEA WebLogic Server) versions 6.1 through SP7
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) versions 10.0 through MP1
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) version 10.2 GA
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) version 10.3 GA
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) version 9.0
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) version 9.1
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) versions 9.2 through MP3
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) versions 8.1 through SP6
Solution
Apply Oracle Critical Patch Update - October 2008 :
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html
References
http://www.vupen.com/english/advisories/2008/2825
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2806.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2805.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2804.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2803.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2802.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2801.html
Credits
Vulnerabilities reported by Esteban Martinez Fayo (Application Security, Inc.), Pete Finnigan, Tony Fogarty (DNV), guyp (Sentrigo), Jack Kanter (Integrigy), Joxean Koret, Alexander Kornbrust (Red Database Security), Slavik Markovich (Sentrigo), Amichai Shulman (Imperva, Inc.), Chris Valasek (IBM Corp), Chris Anley (NGS Software), Jeff Kayser (Jibe Consulting), David Litchfield (NGS Software), and Joshua Tolley (Partnet Inc).
ChangeLog
2008-10-15 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
