Alert

Oracle Products Contain Multiple Vulnerabilities

Last Revised
Alert Code
TA05-117A

Systems Affected

From the Oracle Critical Patch Update - April 2005:

  • Oracle Database 10g Release 1, versions 10.1.0.2, 10.1.0.3, 10.1.0.3.1, 10.1.0.4 (10.1.0.3.1 is supported for Oracle Application Server only)
  • Oracle9i Database Server Release 2, versions 9.2.0.5, 9.2.0.6
  • Oracle9i Database Server Release 1, versions 9.0.1.4, 9.0.1.5, 9.0.4 (9.0.1.5 FIPS) (all of which are supported for Oracle Application Server only)
  • Oracle8i Database Server Release 3, version 8.1.7.4
  • Oracle Application Server 10g Release 2 (10.1.2)
  • Oracle Application Server 10g (9.0.4), versions 9.0.4.0, 9.0.4.1
  • Oracle9i Application Server Release 2, versions 9.0.2.3, 9.0.3.1
  • Oracle9i Application Server Release 1, version 1.0.2.2
  • Oracle Collaboration Suite Release 2, versions 9.0.4.1, 9.0.4.2
  • Oracle E-Business Suite and Applications Release 11i, versions 11.5.0 through 11.5.10
  • Oracle E-Business Suite and Applications Release 11.0
  • Oracle Enterprise Manager Grid Control 10g, versions 10.1.0.2, 10.1.0.3
  • Oracle Enterprise Manager versions 9.0.4.0, 9.0.4.1
  • PeopleSoft EnterpriseOne Applications, versions 8.9 SP2 and 8.93
  • PeopleSoft OneWorldXe/ERP8 Applications, versions SP22 and higher

Overview

Various Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include unauthenticated, remote code execution, information disclosure, and denial of service.

Description

Oracle released a Critical Patch Update in April that addresses more than seventy vulnerabilities in different Oracle products and components. The Critical Patch Update provides information about which components are affected, what access and authorization are required, and how data confidentiality, integrity, and availability may be impacted.

US-CERT strongly recommends that sites running Oracle review the Critical Patch Update, apply patches, and take other mitigating action as appropriate.

Oracle HTTP Server is based on the Apache HTTP Server. According to Oracle, the Critical Patch Update addresses a number of previously disclosed Apache vulnerabilities. Oracle Database Client-only installations are not affected.

US-CERT is tracking all of these issues under VU#948486. As further information becomes available, we will publish individual Vulnerability Notes.

Impact

The impacts of these vulnerabilities vary depending on product or component and configuration. Potential consequences include remote execution of arbitrary code or commands, information disclosure, and denial of service. An attacker who compromises an Oracle database may be able to gain access to sensitive information.

Solution

Apply a patch

Apply the appropriate patches or upgrade as specified in the Oracle Critical Patch Update - April 2005. The update notes that some Oracle patches are cumulative while others are not:

The Oracle Database Server, Enterprise Manager, and the Oracle Application Server patches for this Critical Patch Update are cumulative, and contain all the fixes from the previous Critical Patch Update.

...



E-Business Suite patches are not cumulative, so E-Business Suite customers should refer to previous Critical Patch Updates to identify previous fixes they wish to apply.



Oracle Collaboration Suite patches are not cumulative, so Oracle Collaboration Suite customers should refer to previous Critical Patch Updates to identify previous fixes they wish to apply.

Workarounds

It may be possible to mitigate some vulnerabilities by disabling or removing unnecessary components and restricting network access. Revoking PUBLIC EXECUTE privileges from vulnerable stored procedures may reduce the impact of SQL injection vulnerabilities (VU#982109). For more specific workarounds please see the individual Vulnerability Notes.

Oracle Critical Patch Update - April 2005 contains a workaround for a vulnerability in PeopleSoft.

Appendix A. Vendor Information

Oracle

Please see Oracle Critical Patch Update - April 2005 (PDF) and Critical Patch Updates and Security Alerts.


Appendix B. References


Thanks to Alexander Kornbrust of Red-Database-Security GmbH. Information used in this document came from Red-Database-Security and Oracle. Oracle credits NGS Software Ltd., Integrigy, and Application Security, Inc.

Feedback can be directed to the authors: Art Manion and Jeff Gennari.

Revision History

  • April 27, 2005: Initial release

    Last updated

This product is provided subject to this Notification and this Privacy & Use policy.