Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/14/2018
04:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Oracle: Apply Out-of-Band Patch for Database Flaw ASAP

Flaw in the Java VM component of Oracle's Database Server is easily exploitable, security experts warn.

Oracle this week urged organizations to immediately patch a critical vulnerability in multiple versions of Oracle database that gives attackers a way to completely compromise the technology and gain root access to the underlying server.

The flaw [CVE-2018-3110] exists in the Java VM component of Oracle's Database Server and affects versions 11.2.0.4 and 12.2.0.1 on Windows. It also impacts Oracle Database version 12.1.0.2 on Windows and Oracle Database on Linux and Unix. However, patches for these particular versions of the database were issued with Oracle's July 2018 monthly patch update.

In an out-of-band security advisory Monday, the enterprise software giant described the vulnerability as an issue that can be remotely exploited only by fully authenticated users who are able to create a session with the database. Even so, it urged customers to take immediate action to address the issue. "Due to the nature of this vulnerability, Oracle strongly recommends that customers take action without delay," the advisory noted.

The National Vulnerability Database categorized the threat as easily exploitable. "[It] allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM."

While the flaw exists in the Java VM component, an attacker can exploit the vulnerability to attack other technologies as well. "Successful attacks of this vulnerability can result in takeover of Java VM," the NVD cautioned.

Todd Schell, product manager of security at Ivanti, says the ease with which an attacker can exploit the flaw makes it imperative for organizations using Oracle's database to address the issue immediately. "This out-of-band vulnerability and fix should not be overlooked and delayed until Oracle's next patch update in October," he warned.

Though an attacker does require valid access credentials to exploit the flaw, even a basic user set of credentials — obtained via methods like phishing - would work, he says.

Oracle, like other major security vendors, typically releases security patches and updates on a fixed, publicly available schedule. While companies like Microsoft follow a monthly schedule, Oracle releases its patch updates in a quarterly cycle— in January, April, July, and October. Because of the complexities involved in applying patches to running databases, even that pace is often too hard to keep up with for many organizations.

"Organizations can take ages," to apply patches, even if they are as critical as the one announced this week, says John Holt, founder and chief technology officer at Waratek. "Oracle themselves claim that their average customer runs nearly a year beyond in applying critical patches. Other third-party software testing vendors claim that 86% of even the most serious flaws take more than 30 days to fix."

What makes those numbers especially troubling is the fact that attackers using automated scanners can identify and launch attacks against just announced vulnerabilities within hours of disclosure, Holt says.

With this particular vulnerability though, delay would be inadvisable. Organizations need to realize that vulnerabilities don't get any easier to exploit, he says. "When someone pushes an exploit script into the wild, any two-penny script kiddie will be able to take hostage one of the most popular and widespread database systems in-use by companies and governments in a single click," Holt notes.

For most organizations, the principal risk group for this particular vulnerability is internal actors such as rogue employees. External attackers who have compromised lateral systems in an internal corporate network are another major risk group, Holt says.

"A simple static script will be all that is required," he predicts. "As soon as one is released, then anyone can wield this vulnerability in a single click."

Related Content:

 

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27743
PUBLISHED: 2020-10-26
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
CVE-2020-1915
PUBLISHED: 2020-10-26
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application usi...
CVE-2020-26878
PUBLISHED: 2020-10-26
Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
CVE-2020-26879
PUBLISHED: 2020-10-26
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
CVE-2020-15272
PUBLISHED: 2020-10-26
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version ...