Advisories

CERT-In Advisory CIAD-2018-0030

Multiple Vulnerabilities in Oracle Products

Original Issue Date: October 26, 2018

Severity Rating: High

Software Affected

Oracle E-Business Suite
Oracle Enterprise Manager
Oracle Systems
Oracle Fusion Middleware
Oracle Construction and Engineering Suite
Oracle JD Edwards
Oracle Retail Applications
Oracle MICROS PC Workstation
Oracle MySQL
Oracle Supply Chain Products
Oracle Banking Platform
Oracle Communications Application Session Controller
Oracle Communications Instant Messaging Server
Oracle Communications Convergence
Oracle Communications MetaSolv Solution
Oracle Communications Performance Intelligence Center (PIC) Software
Oracle Communications User Data Repository
Oracle Database
Oracle GoldenGate
Oracle Health Sciences
Oracle Hospitality Cruise Fleet Management
Oracle Hospitality Cruise Shipboard Property Management System
Oracle Hospitality Gift and Loyalty
Oracle Hospitality Guest Access
Oracle Hospitality Materials Control
Oracle Hospitality Reporting and Analytics
Oracle iLearning
Oracle Insurance Applications
Oracle Java SE
Oracle Virtualization
Oracle Support Tools
Oracle PeopleSoft
Oracle Siebel
Oracle Big Data Graph

Details of products & versions affected including CVEs are given in the Advisory.

Overview

Multiple vulnerabilities have been reported in various Oracle products, which could be exploited by an attacker to access sensitive information, bypass security restrictions, data modification, or denial of service conditions on the target application.

Description

Multiple vulnerabilities have been reported across hundreds of different Oracle products, due to unspecified flaws in a number of components. An authenticated/unauthenticated attacker could exploit these vulnerabilities to access sensitive information, bypass security restrictions, modify data, or perform denial of service conditions on the target application.

Users are advised to:

Apply appropriate patches provided by Oracle to vulnerable systems immediately after appropriate testing.
Run Softwares without administrative privileges to minimize the effects of a successful attack.
Do not visit websites or follow links provided by unknown or untrusted sources.

Solution

Apply appropriate patches as mentioned in Oracle Security Bulletin available at
https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Vendor Information

Oracle
https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

References

Oracle
https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Security Tracker
https://www.securitytracker.com/id/1041888
https://www.securitytracker.com/id/1041889
https://www.securitytracker.com/id/1041890
https://www.securitytracker.com/id/1041891
https://www.securitytracker.com/id/1041896
https://www.securitytracker.com/id/1041897
https://www.securitytracker.com/id/1041898
https://www.securitytracker.com/id/1041887

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India