Advisories

CERT-In Advisory CIAD-2017-0046

Multiple Vulnerabilities in Oracle products

Original Issue Date: October 17, 2017

Severity Rating: High

Software Affected

Oracle Database Server
Oracle Communications Applications
Oracle Construction and Engineering Suite
Oracle E-Business Suite
Oracle Enterprise Manager Grid Control
Oracle Financial Services Applications
Oracle Fusion Middleware
Oracle Health Sciences Applications
Oracle Hospitality Applications
Oracle Hyperion
Oracle Java SE
Oracle JD Edwards Products
Oracle MySQL
Oracle PeopleSoft Products
Oracle Retail Applications
Oracle Siebel CRM
Oracle Sun Systems Products Suite
Oracle Supply Chain Products Suite
Oracle Virtualization

Details of products & versions affected including CVEs are given in the Advisory.

Overview

Multiple vulnerabilities have been reported in various Oracle products, which could be exploited by an attacker to access sensitive information, bypass security restrictions, data modification, execute arbitrary code or denial of service conditions on the target application.

Description

Multiple vulnerabilities have been reported across hundreds of different Oracle products, due to unspecified flaws in a number of components. An authenticated/unauthenticated attacker could exploit these vulnerabilities to access sensitive information, bypass security restrictions, modify data, execute arbitrary code or perform denial of service conditions on the target application.

Users are advised to:

Apply appropriate patches provided by Oracle to vulnerable systems immediately after appropriate testing.
Run softwares without administrative privileges to minimize the effects of a successful attack.
Do not visit websites or follow links provided by unknown or untrusted sources.

Solution

Apply appropriate patches as mentioned in Critical Patch Update Advisory:
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Vendor Information

Oracle
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

References

Oracle
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017verbose-3236627.html
https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2310031.1

Security Tracker
https://www.securitytracker.com/id/1039597
https://www.securitytracker.com/id/1039591
https://www.securitytracker.com/id/1039596
https://www.securitytracker.com/id/1039594
https://www.securitytracker.com/id/1039592
https://www.securitytracker.com/id/1039590
https://www.securitytracker.com/id/1039595
https://www.securitytracker.com/id/1039598
https://www.securitytracker.com/id/1039599
https://www.securitytracker.com/id/1039602
https://www.securitytracker.com/id/1039608

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India