Vulnerability

CERT-In Vulnerability Note CIVN-2003-0014
Flaws in OpenSSL protocol can cause DoS and give unauthorized access to Oracle Server products.

Original Issue Date:December 08, 2003

Severity Rating: HIGH

Systems Affected

Oracle9 i Application Server - All Versions.

Oracle9 i Database Server - All Versions.

Oracle8 i Database Server - All Versions.

Oracle HTTP Server - Version: 8.x, 9.x.

Overview

OpenSSL protocol implements SSL and TLS protocols to establish a secure connection between a client and a server. Flaws in OpenSSL implementation may cause buffer overflows. These buffer overflows can be exploited by a malicious user to gain unauthorized access to the Oracle server products. The Oracle Server products that implement OpenSSL and accept client certificates are vulnerable.

Impact

The flaws in OpenSSL protocol can be exploited by an attacker during the handshake process with SSL server. This makes Oracle server products vulnerable to information leakage, Denial-of-Service attack and server takeover by the perpetrator.

Description

OpenSSL is an open-source derivative of SSL and TLS and provides a secure connection between a client and a server. Some vulnerabilities were discovered in OpenSSL implementation earlier like buffer overflow during SSLv2 and SSLv3 handshake process. In October, the OpenSSL Project released new versions to fix these vulnerabilities. Please refer CERT-In Advisory CIAD-2003-0015 on this issue for further details.

The Oracle server products are vulnerable to flaws in OpenSSL protocol and Oracle has termed these vulnerabilities as high risk. These vulnerabilities may give system access to the attacker. No workaround is available which can take care of all these vulnerabilities together. It is advisable to apply patches made available by Oracle to minimize the risk of exposure.

Solution

Apply Patch
Apply appropriate patch as per the availability from
http://metalink.oracle.com.
Appropriate testing and backups should be performed before applying any patch.

Vendor Information

Oracle
Oracle Security Alert 62 Dated: December 4, 2003
http://otn.oracle.com/deploy/security/pdf/2003alert62.pdf

References

Oracle Security Alert
http://otn.oracle.com/deploy/security/pdf/2003alert62.pdf

NISCC
www.niscc.gov.uk

CERT-In advisory on Multiple Vulnerabilities in SSL/TLS Implementations
CIAD-2003-0015

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India