Article

Oracle patches dangerous WebLogic flaw, critical database holes

Robert Westervelt, News Director

Oracle Corp. plugged a severe flaw in the Apache plug-in for its WebLogic Server and addressed vulnerabilities in more than two dozen other products as part of its quarterly Critical Patch Update.

    Requires Free Membership to View

Oracle said its security update contained patches for 36 flaws.

"While their CVSS scores are not as high, I do think that they are actually more threatening than their scores suggest."

Amichai Shulman, Chief Technology Officer, Imperva

Oracle released six fixes to address vulnerabilities for the former BEA product line. Five of the vulnerabilities could be remotely exploited by an attacker. Eric Maurice, manager of security in Oracle's Global Technology Business Unit, warned customers that the most severe vulnerability was located in the Apache plug-in for Oracle WebLogic Server. The flaw could be exploited remotely by an attacker and was given a Common Vulnerability Scoring System (CVSS) base score of 10. The attacker doesn't have to be authenticated and could gain complete control of the server.

The CPU includes 15 new security vulnerability fixes for the Oracle Database. The highest CVSS score was 6.5.One of the more critical vulnerabilities is located in Oracle's core relational database management system and may be remotely exploited without authentication. The vulnerability exploits the network protocol between the Oracle client software and the Oracle server. It abuses the proxy account mechanism in the Oracle server. The flaw affects Oracle database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.2.

Compared to previous CPU's, the October release addressed fewer vulnerabilities, said Amichai Shulman, chief technology officer of Foster City, Calif.-based Imperva. In July, Oracle released 45 database and application fixes. Many of the database fixes released this month repair SQL injection vulnerabilities, he said.

"While their CVSS scores are not as high, I do think that they are actually more threatening than their scores suggest," Shulman said.

Oracle also plugged holes in its Publish and iPublish packages, which implement some of the services required to control and audit changes to specific columns in the database. The flaws affect Oracle database 10.1.0.5, 10.2.0.4, 11.1.0.6.

"These packages have been patched over and over again at least three times in the past two years," Shulman said.

In addition, six new security updates were released for Oracle Application Server. Two updates to Oracle Portal could be remotely exploited without authentication, Oracle said. In addition, four security updates were released to address issues in parts of the Oracle E-Business Suite. Problems in the Oracle Applications Technology Stack and the iSupplier Portal could be remotely exploited without authentication. Both vulnerabilities were given a medium-risk CVSS score of 5.0.

Five security vulnerability fixes were released by Oracle for its PeopleSoft Enterprise and JD Edwards EnterpriseOne products. Oracle said two of the vulnerabilities could be remotely exploited without authentication.

 


There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: