Oracle Products Contain Multiple Vulnerabilities
- Oracle Database 10g Release 1, versions 10.1.0.2, 10.1.0.3, 10.1.0.4
- Oracle9i Database Server Release 2, versions 126.96.36.199, 188.8.131.52
- Oracle9i Database Server Release 1, versions 184.108.40.206, 220.127.116.11, 18.104.22.168 FIPS
- Oracle8i Database Server Release 3, version 22.214.171.124
- Oracle8 Database Release 8.0.6, version 126.96.36.199
- Oracle Enterprise Manager Grid Control 10g, versions 10.1.0.2, 10.1.0.3
- Oracle Enterprise Manager 10g Database Control, versions 10.1.0.2, 10.1.0.3, 10.1.0.4
- Oracle Enterprise Manager Application Server Control, versions 188.8.131.52, 184.108.40.206
- Oracle Application Server 10g (9.0.4), versions 220.127.116.11, 18.104.22.168
- Oracle9i Application Server Release 2, versions 22.214.171.124, 126.96.36.199
- Oracle9i Application Server Release 1, version 188.8.131.52
- Oracle Collaboration Suite Release 2, versions 184.108.40.206, 220.127.116.11
- Oracle E-Business Suite and Applications Release 11i, versions 11.5.1 through 11.5.10
- Oracle E-Business Suite and Applications Release 11.0
- Oracle Workflow, versions 11.5.1 through 18.104.22.168
- Oracle Forms and Reports, versions 22.214.171.124, 126.96.36.199
- Oracle JInitiator, versions 1.1.8, 1.3.1
- Oracle Developer Suite, versions 188.8.131.52, 9.0.4, 184.108.40.206, 9.0.5, 10.1.2
- Oracle Express Server, version 220.127.116.11
Various Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include unauthenticated, remote code execution, information disclosure, and denial of service.
Oracle released a Critical Patch Update in July 2005 that addresses more than forty vulnerabilities in different Oracle products and components. The Critical Patch Update provides information about which components are affected, what access and authorization are required, and how data confidentiality, integrity, and availability may be impacted. Public reports describe vulnerabilities related to insecure password and temporary file handling and SQL injection.
US-CERT strongly recommends that sites running Oracle review the Critical Patch Update, apply patches, and take other mitigating action as appropriate.
Oracle HTTP Server is based on the Apache HTTP Server. Some Oracle products include Java components from Sun Microsystems. According to Oracle, the July 2005 Critical Patch Update addresses previously disclosed vulnerabilities in Apache and Java. Oracle also notes that Oracle Database Client-only installations are not affected by vulnerabilities listed in the July 2005 Critical Patch Update.
The impacts of these vulnerabilities vary depending on product or component and configuration. Potential consequences include remote execution of arbitrary code or commands, information disclosure, and denial of service. An attacker who compromises an Oracle database may be able to gain access to sensitive information.
Apply a patch
Apply the appropriate patches or upgrade as specified in the Oracle Critical Patch Update - July 2005. The update notes that some Oracle patches are cumulative while others are not:
The Oracle Database Server, Enterprise Manager, and the Oracle Application Server patches in the Updates are cumulative; each successive Critical Patch Update contains the fixes from the previous Critical Patch Updates.
E-Business Suite patches are not cumulative, so E-Business Suite customers should refer to previous Critical Patch Updates to identify previous fixes they wish to apply.
Oracle Collaboration Suite patches are not cumulative, so Oracle Collaboration Suite customers should refer to previous Critical Patch Updates to identify previous fixes they wish to apply.
It may be possible to mitigate some vulnerabilities by disabling or removing unnecessary components, restricting network access, and restricting access to temporary files.
Oracle Critical Patch Update - July 2005 suggests setting a TNS listner password to mitigate a vulnerability in Oracle Database Server (DB08).
Appendix A. Vendor Information
Appendix B. References
- Critical Patch Update - July 2005- http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html>
- Critical Patch Updates and Security Alerts - http://www.oracle.com/technology/deploy/security/alerts.htm>
- Map of Public Vulnerability to Advisory/Alert - http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.html>
- US-CERT Vulnerability Note VU#613562 - http://www.kb.cert.org/vuls/id/613562>
- Oracle JDeveloper passes Plaintext Password - http://www.red-database-security.com/advisory/oracle_jdeveloper_passes_plaintext_password.html>
- Oracle JDeveloper Plaintext Passwords - http://www.red-database-security.com/advisory/oracle_jdeveloper_plaintext_password.html>
- Oracle Forms Builder Password in Temp Files - http://www.red-database-security.com/advisory/oracle_formsbuilder_temp_file_issue.html>
- Oracle Forms Insecure Temporary File Handling - http://www.red-database-security.com/advisory/oracle_forms_unsecure_temp_file_handling.html>
- Multiple High Risk Vulnerabilities in Oracle E-Business Suite 11i - http://www.integrigy.com/alerts/OraCPU0705.htm>
Information used in this document came from Red-Database-Security and Oracle. Oracle credits Qualys Inc., Application Security, Inc., Red Database Security GmbH, Integrigy, NGS Software, nCircle Network Security, and Rigel Kent Security.
Feedback can be directed to US-CERT Technical Staff.
July 13, 2005: Initial release