Múltiplas vulnerabilidades em produtos Oracle

Categoria: Alertas

quinta, 17 julho 2008 11:02

Sistemas Operativos Implicados:	Indefinido
Aplicações Implicadas:	Oracle

Foram reportadas múltiplas vulnerabilidades para vários produtos da Oracle. Algumas destas vulnerabilidades podem ser exploradas por utilizadores mal intencionados para causar uma condição de Negação de Serviço (DoS), acesso a informação sensível, elevação de privilégios, comprometer um sistema vulnerável, entre outros.

I. Descrição

Multiple vulnerabilities have been reported for various Oracle products. Some vulnerabilities have unknown impacts while others can be exploited by malicious, local users to gain escalated privileges, by malicious users to cause a DoS (Denial of Service), disclose sensitive information, gain escalated privileges, or compromise a vulnerable system, and by malicious people to bypass certain security restrictions or to cause a DoS.

1) An unspecified error exists in Oracle HTTP Server.

2) A NULL-pointer dereference error in Oracle Internet Directory can be exploited to cause a DoS by sending a specially crafted LDAP request to port 389/TCP or port 636/TCP.

3) A boundary error in the DBMS_AQELM package in Oracle Database can be exploited to cause a buffer overflow by passing an overly large string as a parameter to a procedure.

Successful exploitation of this vulnerability may allow execution of arbitrary code

4) An error due to use of an untrusted library path in a setuid root program can be exploited to gain root privileges.

Successful exploitation of this vulnerability requires access to the database owner account (typically "oracle") or being a member of the oracle installation group (typically "oinstall").

5) Input to the "SHOW" procedure within the "WWV_RENDER_REPORT" package is not properly sanitised before being used. This can be exploited to manipulate PLSQL statements by injecting certain PLSQL code.

Successful exploitation allows to gain full control of a backend Oracle database server via the front end web server.

6) An unspecified vulnerability in WebLogic Server within the ForeignJMS component and in the WebLogic console or server log can be exploited to disclose sensitive information.

7) Some unspecified vulnerabilities in WebLogic Server within in the Console/WLST can be exploited to gain escalated privileges.

8) An unspecified vulnerability in WebLogic Server within the WebLogic plug-ins for Apache, Sun and IIS Web servers can be exploited to disclose sensitive information.

9) An unspecified vulnerability in WebLogic Server within the processing of JSP pages can be exploited to disclose sensitive information.

10) An unspecified vulnerability in WebLogic Server within the UDDI Explorer can be exploited to compromise a vulnerable system.

11) An unspecified vulnerability in WebLogic Server can be exploited to cause a DoS.

The remaining vulnerabilities are caused due to unspecified errors. No more information is currently available.

The vulnerabilities are reported in the following products and versions:
* Oracle Database 11g, version 11.1.0.6
* Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
* Oracle TimesTen In-Memory Database version 7.0.3.0.0
* Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.1.0, 10.1.3.3.0
* Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0
* Oracle Application Server 10g (9.0.4), version 9.0.4.3
* Oracle Hyperion BI Plus version 9.2.0.3, 9.2.1.0,and 9.3.1.0
* Oracle Hyperion Performance Suite version 8.3.2.4, and 8.5.0.3
* Oracle E-Business Suite Release 12, version 12.0.4
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* Oracle Enterprise Manager Database Control 11i version 11.1.0.6
* Oracle Enterprise Manager Database Control 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
* Oracle Enterprise Manager Database Control 10g Release 1, version 10.1.0.5
* Oracle Enterprise Manager Grid Control 10g Release 1, versions 10.1.0.5, 10.1.0.6
* Oracle PeopleSoft Enterprise PeopleTools versions 8.48.17, 8.49.11
* Oracle PeopleSoft Enterprise CRM version 8.9, 9.0
* Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released through MP1
* Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0, 9.1, 9.2 released through MP3
* Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released through SP6
* Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released through SP7
* Oracle WebLogic Server (formerly BEA WebLogic Server) 6.1 released through SP7

II. Solução

Apply patches (see the vendor"s advisory).

III. Referências

Secunia:
http://secunia.com/advisories/31087/