Oracle patches dangerous WebLogic flaw, critical database holes

By Robert Westervelt, News Editor 15 Oct 2008 | SearchSecurity.com

Oracle news and trends Digg This!     StumbleUpon     Del.icio.us

Oracle Corp. plugged a severe flaw in the Apache plug-in for its WebLogic Server and addressed vulnerabilities in more than two dozen other products as part of its quarterly Critical Patch Update. Oracle said its security update contained patches for 36 flaws.

While their CVSS scores are not as high, I do think that they are actually more threatening than their scores suggest. Amichai Shulman, chief technology officer, Imperva

Oracle released six fixes to address vulnerabilities for the former BEA product line. Five of the vulnerabilities could be remotely exploited by an attacker. Eric Maurice, manager of security in Oracle's Global Technology Business Unit, warned customers that the most severe vulnerability was located in the Apache plug-in for Oracle WebLogic Server. The flaw could be exploited remotely by an attacker and was given a Common Vulnerability Scoring System (CVSS) base score of 10. The attacker doesn't have to be authenticated and could gain complete control of the server.

The CPU includes 15 new security vulnerability fixes for the Oracle Database. The highest CVSS score was 6.5.One of the more critical vulnerabilities is located in Oracle's core relational database management system and may be remotely exploited without authentication. The vulnerability exploits the network protocol between the Oracle client software and the Oracle server. It abuses the proxy account mechanism in the Oracle server. The flaw affects Oracle database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.2.

Compared to previous CPU's, the October release addressed fewer vulnerabilities, said Amichai Shulman, chief technology officer of Foster City, Calif.-based Imperva. In July, Oracle released 45 database and application fixes. Many of the database fixes released this month repair SQL injection vulnerabilities, he said.

SearchSecurity radio:

"While their CVSS scores are not as high, I do think that they are actually more threatening than their scores suggest," Shulman said.

Oracle also plugged holes in its Publish and iPublish packages, which implement some of the services required to control and audit changes to specific columns in the database. The flaws affect Oracle database 10.1.0.5, 10.2.0.4, 11.1.0.6.

"These packages have been patched over and over again at least three times in the past two years," Shulman said.

In addition, six new security updates were released for Oracle Application Server. Two updates to Oracle Portal could be remotely exploited without authentication, Oracle said. In addition, four security updates were released to address issues in parts of the Oracle E-Business Suite. Problems in the Oracle Applications Technology Stack and the iSupplier Portal could be remotely exploited without authentication. Both vulnerabilities were given a medium-risk CVSS score of 5.0.

Five security vulnerability fixes were released by Oracle for its PeopleSoft Enterprise and JD Edwards EnterpriseOne products. Oracle said two of the vulnerabilities could be remotely exploited without authentication.

Tags: Security Patch Management,  Database Security Management,  Web Server Threats and Countermeasures,  Web Application and Web 2.0 Threats,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Security Patch Management Squad: Tokenization, Phishing and the Feds Should management processes change based on a patch release schedule? Should Windows Mobile updates come from Microsoft? Adobe updates ColdFusion, JRun, Flex Trusteer CEO criticizes Adobe, touts better patch deployments Patch management study shows IT taking significant risks Vulnerability mitigation study shows need for faster patching Microsoft to issue security report card, new tool at Black Hat How to manage patches for Adobe When is it suitable to remove Java updates? Database Security Management What is the best database patch management process? Unpatched vulnerability discovered in Microsoft SQL Server SQL injection continues to trouble firms, lead to breaches Oracle issues quarterly patches, fixes database flaws Database monitoring, encryption vital in tight economy, Forrester says Oracle to buy Sun Microsystems for $7.4 billion Oracle issues 43 updates, fixes serious database flaws Imperva assigns security risk levels to databases How to create configuration management plans to install DLP Information security book excerpts and reviews Database Security Management Research Web Server Threats and Countermeasures Increase in Gumblar backdoors poses FTP credential problems VeriSign extends DDoS attack protection service Microsoft issues IIS FTP advisory, exploit code circulates Panda reports fast-spreading rogueware antivirus fraud rakes in millions Oracle issues quarterly patches, fixes database flaws Latest DDoS attacks extremely unsophisticated, experts say Stolen FTP credentials likely in massive website attacks Microsoft warns of IIS zero-day vulnerability How to find and stop automated SQL injection attacks How to spot attacks through Apache Web server log analysis

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary attack vector  (SearchSecurity.com) back door  (SearchSecurity.com) ethical worm  (SearchSecurity.com) Patch Tuesday  (SearchSecurity.com) zero-day exploit  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary