4 X Security Team

The next batch of security patches from Oracle will be a biggie: 73 new security vulnerability fixes across hundreds of Oracle products.

According to an advance notice from the database server giant, some of the vulnerabilities affect multiple products and may be exploited over a network without the need for a username and password.

The patches, scheduled for release next Tuesday (April 19, 2011), will affect the following products and components:

Security vulnerabilities addressed by this Critical Patch Update affect the following products:

• Oracle Database 11g Release 2, versions 11.2.0.1, 11.2.0.2
• Oracle Database 11g Release 1, version 11.1.0.7
• Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5
• Oracle Database 10g Release 1, version 10.1.0.5
• Oracle Fusion Middleware 11g Release 1, versions 11.1.1.2.0, 11.1.1.3.0, 11.1.1.4.0
• Oracle Application Server 10g Release 3, version 10.1.3.5.0
• Oracle Application Server 10g Release 2, version 10.1.2.3.0
• Oracle Identity Management 10g, versions 10.1.4.0.1, 10.1.4.3
• Oracle JRockit, versions R27.6.8 and earlier (JDK/JRE 1.4.2, 5, 6), R28.1.1 and earlier (JDK/JRE 5, 6)
• Oracle Outside In Technology, versions 8.3.2.0, 8.3.5.0
• Oracle WebLogic Server, versions 8.1.6, 9.2.3, 9.2.4, 10.0.2, 11gR1 (10.3.2, 10.3.3, 10.3.4)
• Oracle E-Business Suite Release 12, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3
• Oracle E-Business Suite Release 11i, version 11.5.10.2
• Oracle Agile Technology Platform, versions 9.3.0.2, 9.3.1
• Oracle PeopleSoft Enterprise CRM, version 8.9
• Oracle PeopleSoft Enterprise ELS, versions 9.0, 9.1
• Oracle PeopleSoft Enterprise HRMS, versions 9.0, 9.1
• Oracle PeopleSoft Enterprise Portal, versions 8.8, 8.9, 9.0, 9.1
• Oracle PeopleSoft Enterprise People Tools, versions 8.49, 8.50, 8.51
• Oracle JD Edwards OneWorld Tools, version 24.1.x
• Oracle JD Edwards EnterpriseOne Tools, version 8.98.x
• Oracle Siebel CRM Core, versions 7.8.2, 8.0.0, 8.1.1
• Oracle InForm, versions 4.5, 4.6, 5.0
• Oracle Sun Product Suite
• Oracle Open Office, version 3 and StarOffice/StarSuite, versions 7, 8

The highest CVSS 2.0 Base Score for vulnerabilities in this Critical Patch Update is 10.0 for Oracle JRockit of Oracle Fusion Middleware and Sun GlassFish Enterprise Server, Sun Java System Application Server of Oracle Sun Products Suite, the company said.

“Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.

[Source: zdnet]

Database security vendor Sentrigo has released an open-source fuzz testing tool to help pinpoint security-related coding deficiencies in Oracle databases.

The tool, called FuzzOr, runs on Oracle 8i and is aimed at PL/SQL programmers and DBAs looking to find and eliminate vulnerabilities that may be exploited via SQL injection and buffer overflow attacks — the most common techniques used to launch hacker attacks on databases.

[ SEE: Hacker finds 492,000 unprotected Oracle, SQL database servers ]

From Sentrigo’s announcement:

• A dynamic scanning tool, FuzzOr enables DBAs and security pros to test PL/SQL code inside Oracle-stored program units. Once vulnerabilities are detected by FuzzOr, a programmer can then repair the PL/SQL code.

Pete Finnigan, who had a look at FuzzOr prior to today’s release, explains the nitty-gritty of how it works:

• It’s written in PL/SQL, tests PL/SQL packages, functions and procedures and is driven by a set of database tables to hold the configuration and the results. The idea is that you can target a particular package or a complete schema.
• The nature of a fuzzer is that it sends random input to a particular function or procedure so its running that code hoping to crash it. Therefore do not run this tool on a production database or any database that you do not want to damage.

The tool is available as a free download (registration required).

[Source: zdnet]

Oracle has dropped the first quarterly critical patch update for 2009 — with patches for 41 vulnerabilities in a wide range of database server products.

The January 2009 CPU includes 20 new security fixes for the company’s flagship database product lines, 4 new security fixes for the Oracle Application Server, 9 vulnerabilities in Oracle Secure Backup, 4 new security fixes for the Oracle Applications Suite, and 6 new security fixes for the PeopleSoft and JDEdwards Suite.

On the Oracle Database side, here’s a breakdown of the main patches:

• 10 new security fixes for the Oracle Database. None of these vulnerabilities may be remotely exploitable without authentication, i.e. may be exploited over a network without the need for a username and password. 2 of these fixes are applicable to client-only installations, i.e. installations that do not have an Oracle Database installed.
• 9 new security fixes for the Oracle Secure Backup product. All of these vulnerabilities may be remotely exploitable without authentication, i.e. may be exploited over a network without the need for a username and password.
• 1 new security fix for the Oracle TimesTen Data Server. This vulnerability is remotely exploitable without authentication, i.e. may be exploited over a network without the need for a username and password.

According to Alexander Kornbrust from Red Database Security, the most critical bug could allow any user with execute privileges on dbms_ijob (e.g. DBA or hacker/user with DBA privs) to bypass Oracle Auditing completely.

This means no traces in the AUD$ and/or the operating system! All databases are affected.

Risk matrix definitions, including CVSS scores for all the vulnerabilities, are included in Oracle’s advisory.

* Image source: Oracle Security at Amazon.com.

[Source: zdnet]

oftware, Middleware, Databases, Internet, Software

Microsoft may be offering a Patch Tuesday respite this month but, if you’re an Oracle database administrator, January 13 will be a very busy day.

The database server giant announced plans for a monster Patch Day next Tuesday with fixes for 41 security vulnerabilities in “across hundreds of Oracle products.”

The first CPU (Critical Patch Update) for 2009 includes patches for flaws that affect multiple products, the company said. “Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.”

The following products are affected:

[ SEE: Microsoft planning quiet Patch Tuesday (1 critical) ]

• Oracle Database 11g, version 11.1.0.6
• Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
• Oracle Database 10g, version 10.1.0.5
• Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
• Oracle Secure Backup version 10.2.0.2, 10.2.0.3
• Oracle Secure Backup version 10.1.0.1, 10.1.0.2, 10.1.0.3
• Oracle TimesTen In-Memory Database version 7.0.5.1.0, 7.0.5.2.0, 7.0.5.3.0, 7.0.5.4.0
• Oracle Application Server 10g Release 3 (10.1.3), version 10.1.3.3.0
• Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0
• Oracle Collaboration Suite 10g, version 10.1.2
• Oracle E-Business Suite Release 12, version 12.0.6
• Oracle E-Business Suite Release 11i, version 11.5.10.2
• Oracle Enterprise Manager Grid Control 10g Release 4, version 10.2.0.4
• PeopleSoft Enterprise HRMS versions 8.9, 9.0 and 9.1
• JD Edwards Tools version 8.97
• Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released through MP1, 10.3 GA
• Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0 GA, 9.1 GA, 9.2 released through MP3
• Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released through SP6
• Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released through SP7
• Oracle WebLogic Portal (formerly BEA WebLogic Portal) 10.0 released through MP1, 10.2 GA, 10.3 GA
• Oracle WebLogic Portal (formerly BEA WebLogic Portal) 9.2 released through MP3
• Oracle WebLogic Portal (formerly BEA WebLogic Portal) 8.1 released through SP6

Additional details, including CVSS scores and affected components can be found in Oracle’s advance notice.

[Source: zdnet]

For the first time since the introduction of its quarterly Critical Patch Update process, Oracle has released an emergency alert to offer mitigation for a zero-day exploit that’s been posted on the Internet.

The emergency workaround, available here, addresses an unpatched vulnerability that’s remotely exploitable without authentication ( it may be exploited over the network without the need for a username and password) and can result in compromising the confidentiality, integrity, and availability of the targeted system.

[ SEE: Hacker finds 492,000 unprotected Oracle, SQL database servers ]

Oracle’s Eric Maurice says the vulnerability carries a CVSS Base Score of 10.0, the maximum severity rating:

When Oracle became aware of this issue, our security and development teams worked diligently to develop an effective workaround to prevent a successful exploitation of the vulnerability. Detailed instructions for this workaround have been posted on the eSupport site, and Oracle has already issued a Security Alert to all WebLogic customers to let them know about this workaround. In addition, Oracle will also issue an out-of-cycle security patch for this vulnerability as soon as the fix has been produced for all supported version-platform combinations. We expect this fix to be ready very soon, and we will issue an updated Security Alert to let customers know about its availability. In the meanwhile, we recommend that all customers implement the recommended workaround.

Unfortunately, the person(s) who published this vulnerability and associated exploit codes did not contact Oracle before publicly disclosing this issue. This means that the vulnerability was made public before providing Oracle an opportunity to develop an appropriate fix for this issue and notify its customers. In addition, the vulnerability was made public shortly after the publication of the July 15th Critical Patch Update, therefore prompting Oracle to issue an out of cycle security update.

This IBM ISS alert provides some technical details:

Oracle WebLogic Server (formerly known as BEA WebLogic Server) is vulnerable to a buffer overflow, caused by improper bounds checking by the Apache Connector. By sending a specially-crafted HTTP POST request, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

The emergency alert comes less than two weeks after the database server giant shipped patches for a total of 45 security vulnerabilities, bringing the vulnerability count for 2008 to a whopping 112.

* Photo credit: eMaringolo’s Flickr photostream (Creative Commons 2.0)

[Source: zdnet]

More details coming out on the Oracle patches that were released last week, see Ryan Naraine’s write up here. David Litchfield, noted security researcher from NGSSoftware, released details of one of the vulnerabilities on the Full-Disclosure email list today, and the details are staggering. The flaw allows potential unauthenticated remote exploitation resulting in full control of the database server. One thing that I think is key to note here is that this vulnerability was reported in October of 2007 and is just now getting patched in July of 2008. End result is, if you are using Oracle, get patched ASAP.
Read the details below…

Litchfield’s details are provided below:

Name: PLSQL Injection in Oracle Application Server
Systems Affected: Oracle Application Server 9.0.4.3, 10.1.2.2, 10.1.4.1
Severity: Critical
Vendor URL: http://www.oracle.com/
Author: David Litchfield [ davidl@ngssoftware.com ]
Reported: 9th October 2007
Date of Public Advisory: 15th July 2008
Advisory number: #NISR15072008
CVE: CVE-2008-2589

Overview
********
Oracle has just released a fix for a flaw that, when exploited, allows an unauthenticated attacker on the Internet to gain full control of a backend Oracle database server via the front end web server.

Details
*******
Oracle Application Server installs a number of PLSQL packages in the backend
database server. One of these is the WWV_RENDER_REPORT package and it is vulnerable to PLSQL injection. This package uses definer rights execution and therefore executes with the privileges of the owner, in this case the highly privileged PORTAL user.

Specifically, the SHOW procedure takes as its 2nd argument the name of a function to execute and this is embedded with a dynamically executed anonymous block of PLSQL without first being sanitized. Because it is a block of anonymous PLSQL, an attacker can exploit this flaw to run any SQL statement, for example, create new users, grant dba privileges, delete or
modify data. This is achieved by wrapping the statement(s) within an “execute immediate” statement and specifying the autonomous_transaction pragma.

[Source: zdnet]