Vulnerabilities / Threats
7/13/2010
12:30 PM
Connect Directly
RSS
E-Mail
50%
50%

Oracle Patches 59 Vulnerabilities

Sun Solaris product suite, Oracle Database Server, Fusion Middleware, and Supply Chain Products Suite vulnerable to remote exploitation, with no authentication required.

Oracle is set to patch 59 vulnerabilities in its products Tuesday as part of its quarterly Critical Patch Update program. Of those vulnerabilities, 21 are in the Solaris product suite.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible," the company said in a statement.

The patch update contains 13 new security fixes for the Oracle Database Server, patching eight different Oracle Database components: Application Express, Export, Listener, Net Foundation Layer, Network Layer, Oracle OLAP, Oracle Secure Backup, and TimesTen In-Memory Database.

Six of the fixes are for Oracle Database Server itself, and four of those vulnerabilities can be remotely exploitable without authentication -- as in, no username or password would be required. Two of the fixes are for the TimesTen In-Memory Database, and can also be exploited remotely, without authentication. Finally, there are five security fixes for Oracle Secure Backup, three of which are remotely exploitable without authentication.

In terms of severity, the vulnerabilities affecting the TimesTen In-Memory Database and Oracle Secure Backup rate a "10" -- the highest possible severity rating -- on Oracle's interpretation of version 2.0 of the common vulnerability scoring system (CVSS), an open standard for rating software vulnerabilities. CVSS takes into account the preconditions required for exploiting a vulnerability, the ease of exploitation, and the impact of a successful attack, using a formula to convert the vulnerability threat into a numeric score between 0 and 10, to help IT managers know which threats to remediate first.

For the Oracle Solaris Products Suite, seven of the 21 vulnerabilities could be remotely exploitable without authentication. The same goes for five of the seven vulnerabilities patched in Oracle Fusion Middleware and for one critical vulnerability in Oracle Enterprise Manager.

For Oracle applications, the Critical Patch Update includes seven new security fixes for Oracle E-Business Suite; five can be remotely exploitable without authentication. Oracle Supply Chain Products Suite gets two fixes, one exploitable remotely without authentication. Finally, the Oracle PeopleSoft and JDEdwards Suite gets eight patches, none of which can be remotely exploitable without authentication.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant