Oracle Products Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

Home > Vulnerability Intelligence > Secunia Advisories > Oracle Products Multiple Vulnerabilities

Secunia Advisories

Advisories

Advisories by Product

Business Solutions Restricted

Partner Solutions Restricted

About

Oracle Products Multiple Vulnerabilities
Secunia Advisory:	SA31087	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2008-07-16
Last Update:	2008-07-30
Popularity:	5,624 views

Critical:	Highly critical
Impact:	Cross Site Scripting Manipulation of data Exposure of sensitive information Privilege escalation DoS System access Security Bypass Unknown
Where:	From remote
Solution Status:	Vendor Patch

Software:	BEA WebLogic Express 10.x BEA WebLogic Express 7.x BEA WebLogic Express 8.x BEA WebLogic Express 9.x BEA WebLogic Server 10.x BEA WebLogic Server 6.x BEA WebLogic Server 7.x BEA WebLogic Server 8.x BEA WebLogic Server 9.x Oracle Application Server 10g Oracle Database 10.x Oracle Database 11.x Oracle E-Business Suite 11i Oracle E-Business Suite 12.x Oracle Enterprise Manager 10.x Oracle Hyperion Business Intelligence Plus 9.x Oracle Hyperion Performance Suite 8.x Oracle PeopleSoft Enterprise Customer Relationship Management (CRM) 9.x Oracle PeopleSoft Enterprise Tools 8.x Oracle Times-Ten In-Memory Database 7.x Oracle9i Application Server Oracle9i Database Enterprise Edition Oracle9i Database Standard Edition

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2007-1359 CVE-2008-2576 CVE-2008-2577 CVE-2008-2578 CVE-2008-2579 CVE-2008-2580 CVE-2008-2581 CVE-2008-2582 CVE-2008-2583 CVE-2008-2585 CVE-2008-2586 CVE-2008-2587 CVE-2008-2589 CVE-2008-2590 CVE-2008-2591 CVE-2008-2592 CVE-2008-2593 CVE-2008-2594 CVE-2008-2595 CVE-2008-2596 CVE-2008-2597 CVE-2008-2598 CVE-2008-2599 CVE-2008-2600 CVE-2008-2601 CVE-2008-2602 CVE-2008-2603 CVE-2008-2604 CVE-2008-2605 CVE-2008-2606 CVE-2008-2607 CVE-2008-2608 CVE-2008-2609 CVE-2008-2610 CVE-2008-2611 CVE-2008-2612 CVE-2008-2613 CVE-2008-2614 CVE-2008-2615 CVE-2008-2616 CVE-2008-2617 CVE-2008-2618 CVE-2008-2620 CVE-2008-2621 CVE-2008-2622

Description: Multiple vulnerabilities have been reported for various Oracle products. Some vulnerabilities have unknown impacts while others can be exploited by malicious, local users to gain escalated privileges, by malicious users to cause a DoS (Denial of Service), disclose sensitive information, gain escalated privileges, conduct SQL injection attacks, or compromise a vulnerable system, and by malicious people to bypass certain security restrictions, conduct cross-site scripting and SQL injection attacks, or to cause a DoS. 1) An unspecified error exists in Oracle HTTP Server. This is related to: SA24373 2) A NULL-pointer dereference error in Oracle Internet Directory can be exploited to cause a DoS by sending a specially crafted LDAP request to port 389/TCP or port 636/TCP. 3) A boundary error in the DBMS_AQELM package in Oracle Database can be exploited to cause a buffer overflow by passing an overly large string as a parameter to a procedure. Successful exploitation of this vulnerability may allow execution of arbitrary code 4) An error due to use of an untrusted library path in a setuid root program can be exploited to gain root privileges. Successful exploitation of this vulnerability requires access to the database owner account (typically "oracle") or being a member of the oracle installation group (typically "oinstall"). 5) Input to the "SHOW" procedure within the "WWV_RENDER_REPORT" package is not properly sanitised before being used. This can be exploited to manipulate PLSQL statements by injecting certain PLSQL code. Successful exploitation allows to gain full control of a backend Oracle database server via the front end web server. 6) An unspecified vulnerability in WebLogic Server within the ForeignJMS component and in the WebLogic console or server log can be exploited to disclose sensitive information. 7) Some unspecified vulnerabilities in WebLogic Server within in the Console/WLST can be exploited to gain escalated privileges. 8) An unspecified vulnerability in WebLogic Server within the WebLogic plug-ins for Apache, Sun and IIS Web servers can be exploited to disclose sensitive information. 9) An unspecified vulnerability in WebLogic Server within the processing of JSP pages can be exploited to disclose sensitive information. 10) An unspecified vulnerability in WebLogic Server within the UDDI Explorer can be exploited to compromise a vulnerable system. 11) An unspecified vulnerability in WebLogic Server can be exploited to cause a DoS. 12) Input passed to the "REFRESHCHOICE" and "REFRESHHOME" parameters in web pages of Oracle Enterprise Manager is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 13) Input passed via the "ACTION" procedure in the PL/SQL package WWEXP_API_ENGINE is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 14) Input passed via the "DELETE_TRAN" procedure in the PL/SQL package DBMS_DEFER_SYS is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The remaining vulnerabilities are caused due to unspecified errors. No more information is currently available. The vulnerabilities are reported in the following products and versions: * Oracle Database 11g, version 11.1.0.6 * Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4 * Oracle Database 10g, version 10.1.0.5 * Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV * Oracle TimesTen In-Memory Database version 7.0.3.0.0 * Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.1.0, 10.1.3.3.0 * Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0 * Oracle Application Server 10g (9.0.4), version 9.0.4.3 * Oracle Hyperion BI Plus version 9.2.0.3, 9.2.1.0,and 9.3.1.0 * Oracle Hyperion Performance Suite version 8.3.2.4, and 8.5.0.3 * Oracle E-Business Suite Release 12, version 12.0.4 * Oracle E-Business Suite Release 11i, version 11.5.10.2 * Oracle Enterprise Manager Database Control 11i version 11.1.0.6 * Oracle Enterprise Manager Database Control 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4 * Oracle Enterprise Manager Database Control 10g Release 1, version 10.1.0.5 * Oracle Enterprise Manager Grid Control 10g Release 1, versions 10.1.0.5, 10.1.0.6 * Oracle PeopleSoft Enterprise PeopleTools versions 8.48.17, 8.49.11 * Oracle PeopleSoft Enterprise CRM version 8.9, 9.0 * Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released through MP1 * Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0, 9.1, 9.2 released through MP3 * Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released through SP6 * Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released through SP7 * Oracle WebLogic Server (formerly BEA WebLogic Server) 6.1 released through SP7 Solution: Apply patches (see the vendor's advisory). Provided and/or discovered by: The vendor credits: * Flavio Casetta of Yocoya * Esteban Martinez Fayo of Application Security, Inc. * Johannes Greil, SEC Consult * guyp, Sentrigo * Joxean Koret * Alexander Kornbrust, Red Database Security * Stephen Kost, Integrigy * Dave Lewis * David Litchfield, NGS Software * Hirofumi Oka, JPCERT/CC Vulnerability Handling Team * Tanel Poder * Alexandr Polyakov, Digital Security * Andrea Purificato * Dave Wichers, Aspect Security Changelog: 2008-07-18: Added JVN link. 2008-07-30: Added vulnerabilities #12, #13, and #14. Added links to Application Security Inc.. Original Advisory: Oracle: http://www.oracle.com/technology/depl...ritical-patch-updates/cpujul2008.html Oracle / BEA: https://support.bea.com/application_c...portlets/securityadvisories/2782.html https://support.bea.com/application_c...portlets/securityadvisories/2790.html https://support.bea.com/application_c...portlets/securityadvisories/2789.html https://support.bea.com/application_c...portlets/securityadvisories/2785.html https://support.bea.com/application_c...portlets/securityadvisories/2786.html https://support.bea.com/application_c...portlets/securityadvisories/2791.html https://support.bea.com/application_c...portlets/securityadvisories/2792.html iDefense: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=725 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=726 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=727 David Litchfield: http://archives.neohapsis.com/archives/fulldisclosure/2008-07/0240.html Application Security Inc.: http://www.appsecinc.com/resources/alerts/oracle/2008-04.shtml http://www.appsecinc.com/resources/alerts/oracle/2008-05.shtml http://www.appsecinc.com/resources/alerts/oracle/2008-06.shtml http://www.appsecinc.com/resources/alerts/oracle/2008-07.shtml Other References: SA24373: http://secunia.com/advisories/24373/ JVN#81667751: http://jvn.jp/jp/JVN81667751/index.html

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

5th Sep, 2008

New advisories:	14
New vulnerabilities:	18
Updated advisories:	22

Less // 123 views

Netgear WN802T Wireless Access Point Two Vulnerabilities

Less // 92 views

Fedora update for xastir

Less // 142 views

XASTIR Insecure Temporary Files

Less // 110 views

Fedora update for samba

Less // 123 views

Fedora update for bitlbee

Less // 420 views

3Com Wireless 8760 Access Point HTTP Request Processing Denial of Service

Moderately // 366 views

CS-Cart "cs_cookies" SQL Injection Vulnerability

Less // 406 views

Drupal Content Construction Kit Script Insertion Vulnerabilities

Less // 451 views

HP OpenView Select Identity Connectors Information Disclosure

Moderately // 345 views

rPath update for libtiff

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.