|
Home   Programs Emergency management Response CCIRC Analytical releases2 AV06-013: Multiple vulnerabilities in Oracle products
Number: AV06-013
Date: 20 April 2006 PurposeThe purpose of this advisory is to bring attention to multiple vulnerabilities that have been identified in various Oracle products.
AssessmentThe vulnerabilities could be exploited by remote or local attackers to cause a denial of service, execute arbitrary commands, read and overwrite arbitrary files, disclose sensitive information, conduct SQL injection attacks, or bypass certain security restrictions. These flaws are due to errors in various components (e.g. ModPL/SQL for Apache or Email Server). US-CERT has confirmed that the The PL/SQL Gateway vulnerability identified as PLSQL01 in the Oracle Critical Patch Update corresponds to US-CERT Vulnerability Note VU#169164, which includes further details including workarounds. Products affected:
Oracle9i Database Release 2 version 9.2.0.7
Oracle9i Database Release 2 version 9.2.0.6
Oracle9i Database Release 1 version 9.0.1.5 FIPS
Oracle9i Database Release 1 version 9.0.1.5
Oracle9i Database Release 1 version 9.0.1.4
Oracle9i Collaboration Suite Release 2 version 9.0.4.2
Oracle9i Application Server Release 1 version 1.0.2.2
Oracle8i Database Release 3 version 8.1.7.4
Oracle8 Database Release 8.0.6 version 8.0.6.3
Oracle Workflow versions 11.5.1 through 11.5.9.5
Oracle Pharmaceutical Applications versions 4.5.0 through 4.5.2 Oracle PeopleSoft Enterprise Tools versions 8.47GA through 8.47.04 Oracle PeopleSoft Enterprise Tools versions 8.46GA through 8.46.12 Oracle Enterprise Manager 10g Grid Control version 10.2.0.1 Oracle Enterprise Manager 10g Grid Control version 10.1.0.4 Oracle Enterprise Manager 10g Grid Control version 10.1.0.3 Oracle E-Business Suite Release 11i versions 11.5.1 through 11.5.10 CU2 Oracle E-Business Suite Release 11.0 Oracle Developer Suite version 9.0.4.2 Oracle Developer Suite version 6i
Oracle Database 10g Release 2 version 10.2.0.2
Oracle Database 10g Release 2 version 10.2.0.1
Oracle Database 10g Release 1 version 10.1.0.5
Oracle Database 10g Release 1 version 10.1.0.4.2
Oracle Database 10g Release 1 version 10.1.0.4
Oracle Collaboration Suite 10g Release 1 version 10.1.2.1 Oracle Collaboration Suite 10g Release 1 version 10.1.2.0 Oracle Collaboration Suite 10g Release 1 version 10.1.1 Oracle Application Server 10g Release 2 version 10.1.3.0.0 Oracle Application Server 10g Release 2 version 10.1.2.1.0 Oracle Application Server 10g Release 2 version 10.1.2.0.2 Oracle Application Server 10g Release 2 version 10.1.2.0.1 Oracle Application Server 10g Release 2 version 10.1.2.0.0 Oracle Application Server 10g Release 1 version 9.0.4.2 Oracle Application Server 10g Release 1 version 9.0.4.1 JD Edwards EnterpriseOne Tools versions 8.95 through 8.95.J1 OneWorld Tools versions 8.95 through 8.95.J
Suggested action:PSEPC recommends that administrators test and apply the patches provided in the Oracle Critical Patch Update - April 2006 at the earliest opportunity. Related links:
Oracle Critical Patch Update - April 2006: http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html
US-CERT Technical Cyber Security Alert TA06-109A: http://www.us-cert.gov/cas/techalerts/TA06-109A.html
US-CERT Vulnerability Note VU#169164: http://www.kb.cert.org/vuls/id/169164
FrSIRT advisory notification: http://www.frsirt.com/english/advisories/2006/1397
Secunia Advisory: http://secunia.com/advisories/19712/ Note to ReadersPublic Safety and Emergency Preparedness Canada (PSEPC) collects information related to cyber and physical threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at (613) 991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail. Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at (613) 993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at (613) 993-9620. For urgent matters or to report any incidents, please contact the Government Operations Centre at: Phone: (613) 991-7000
Fax: (613) 996-0995
Secure Fax: (613) 991-7094
Email: goc-cog@psepc-sppcc.gc.ca For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at: Telephone: (613) 944-4875 or 1-800-830-3118
Fax: (613) 998-9589
E-mail: communications@psepc-sppcc.gc.ca
Web: www.psepc.gc.ca
|
Printable version
Send this page