Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/17/2012
12:12 AM
50%
50%

3 Must-Fix Vulnerabilities Top Oracle CPU Patches

Two CVSS 10.0 and one 9.0 flaws top the charts on a Critical Patch Update list chock full of remotely exploitable vulnerabilities

Systems administrators on all IT fronts will have their hands busy patching Oracle vulnerabilities across the software giant's portfolio with the release this week of the company's quarterly Critical Patch Update. Security experts warn enterprises to pay particular attention to this last CPU of the year, which today took the wraps off over 100 fixes affecting 10 different product groups, with one or more vulnerabilities in each group open to remote exploitation without exploitation.

[Forgetting something? Don't get caught with your patch down. See 5 Systems Your Forgetting To Patch. ]

Of particular note among the fixed vulnerabilities named by Oracle were two flaws with a CVSS base score of 10.0, one for the Core RDBMS database product and one for Oracle Fusion Middleware's JRockit component, as well as another MySQL flaw with a CVSS score of 9.0. According to Oracle, the highly critical JRockit fix was actually part of a broader Java SE Critical Patch to address multiple vulnerabilities affecting the Java Runtime Environment, some of which security pundits expected to address zero-day vulnerabilities disclosed by Security Explorations last month.

"Many were anticipating Oracle would patch Java Runtime Environment (JRE), which they did with Java Runtime Environment Version 7 Update 9 and Version 6 Update 37," says Marcus Carey, security Researcher for Rapid7. "I advise everyone who needs Java to update as soon as possible."

According to Wolfgang Kandek, CTO of Qualys, Java is a frequently neglected piece of software within many enterprise patch processes, an opportunity many hackers have not failed to take advantage of.

"In our research into the vulnerability update cycle, we frequently see Java as being one of the slowest moving applications to be updated, frequently many update cycles behind in patching," Kandek says. "Attackers have adapted to this reality, and many modern exploits go first for a Java based attack, as they know that existing, well-known vulnerabilities can be exploited reliably."

Meanwhile, on the database front, the biggest vulnerability out of the five named within the Core RDBMS product group was a flaw disclosed by Application Security, Inc. researchers in 2010 around the way that Oracle 11 g handled its log-in protocol.

"We're calling it stealth password cracking and it's a vulnerability in the log-in protocol introduced when they released 11g," says Josh Shaul, CTO of Application Security, explaining the flaw allowed for attackers to guess passwords based on information sent to the client by the database.

According to Shaul, Oracle had previously intimated to Application Security that it wasn't going release a CPU update for the flaw, which led to the database security company planning a meticulous public disclosure of the flaw to its customer base and the public at large. Oracle changed course on its decision, which led to Application Security only partially disclosing vulnerability details at a conference in Argentina last month and delaying more detailed disclosure information until after the CPU was released.

"Oracle really struggled with this one because it is a protocol-level issue, which meant that it impacts not just the database but all the clients," he says. "What Oracle explained to us what they were going to do in the CPU was just turn off the Oracle log-in protocol--basically downgrading everyone."

While this reverts back to a lack of case sensitivity in Oracle authentication, that's better than a vulnerability in the environment, Shaul says.

While its CVSS rating was slightly lower, the other major database vulnerability in MySQL deserves equal scrutiny from users, warns Carey.

"That one frightens me more than any of them," he says.

The reason being that according to recent Rapid7 research, half of MySQL deployment instances don't use host based access control. And with so many content management systems like Wordpress using MySQL out on the internet, there is an opportunity for a huge malware outbreak if attackers leverage severe vulnerabilities with scores of 9 or 10 that have lots of potential for remote exploit.

"I fear there could be a major outbreak of MySQL being exploited on massive scale and since so many content management systems use it you could actually find attackers inserting malicious content into the database to have that render and exploit a lot of people," he says.

Beyond those extremely severe vulnerabilities pointed out by the experts, there are dozens more that hold plenty of potential for problems if they aren't addressed in a timely fashion. According to Chris Eng, vice president of research for Veracode, as organizations prioritize it will pay to specifically survey the risks to the install base within their environments and the data processed by those applications.

"If you have really severe issues in data document management server but you're only using that for not very important documents then it may not be that important that you patch that right away," he says. "Maybe you have some cross-site-scripting vulnerabilities in an Oracle product you have deployed that's public-facing. In that case that's going to be more important to patch sooner, even if the severity is lower, because it's public-facing."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...