Some vulnerabilities have been reported in various Oracle products. Some vulnerabilities have unknown impacts while others can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct brute force attacks or bypass certain security restrictions.

1) An error in PeopleTools' authentication mechanism can be exploited to conduct brute force attacks.

2) An error in Oracle DBMS can be exploited to bypass the authentication mechanism via a specially crafted authentication message sent to the database server.

Successful exploitation requires knowledge of the session ID and the serial number of an existing session opened through the proxy account, and that "proxy authentication mode" is used.

3) A weakness in Oracle Application Express (APEX) is caused due to excessive privileges assigned to the FLOWS database account.

4) Input is not properly sanitised before being used in the COMPRESSWORKSPACETREE, MERGEWORKSPACE, and REMOVEWORKSPACE procedures within the "LT" PL/SQL package of the Oracle Workspace Manager component. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS or WMSYS).

5) Input is not properly sanitised before being used in the COMPRESSSTATE and GOTOTS procedures within the "LTADM" PL/SQL package of the Oracle Workspace Manager component. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS or WMSYS).

Successful exploitation of this vulnerability requires the "EXECUTE" privilege on the package [WM]SYS.LTADM.

6) Input is not properly sanitised before being used in the ALTER_AUTOLOG_CHANGE_SOURCE procedure within the "DBMS_CDC_PUBLISH" PL/SQL package. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS).

Successful exploitation of this vulnerability requires the "EXECUTE" privilege on the package SYS.DBMS_CDC_PUBLISH.

7) Input is not properly sanitised before being used in the ALTER_HOTLOG_INTERNAL_CSOURCE procedure within the "DBMS_CDC_IPUBLISH" PL/SQL package. This can be exploited to manipulate and execute SQL queries with escalated privileges (SYS).

Successful exploitation of this vulnerability requires the "EXECUTE privilege on the package SYS.DBMS_CDC_IPUBLISH.

The remaining vulnerabilities are caused due to unspecified errors. No more information is currently available.

The vulnerabilities are reported in the following products and versions:
* Oracle Database 11g, version 11.1.0.6
* Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
* Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.3.0,10.1.3.4.0
* Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0
* Oracle Application Server 10g (9.0.4), version 9.0.4.3
* Oracle E-Business Suite Release 12, version 12.0.4
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* Oracle PeopleSoft Enterprise PeopleTools versions 8.48.18, 8.49.14
* Oracle PeopleSoft Enterprise Portal versions 8.9, 9.0
* Oracle JD Edwards EnterpriseOne Tools versions 8.97, 8.98
* Oracle Application Server 9i Release 1, version 1.0.2.2

Solution
Apply patches (see the vendor's advisory).

Provided and/or discovered by
The vendor credits:
* Esteban Martinez Fayo, Application Security, Inc.
* Pete Finnigan
* Tony Fogarty, DNV
* guyp, Sentrigo
* Jack Kanter, Integrigy
* Joxean Koret
* Alexander Kornbrust, Red Database Security
* Slavik Markovich, Sentrigo
* Amichai Shulman, Imperva, Inc.
* Chris Valasek, IBM Corp.

1) Yaniv Azaria, Imperva

Changelog
Further details available in Customer Area

Original Advisory
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html

Amichai Shulman, Yaniv Azaria:
http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065146.html
http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065147.html

Pete Finnigan:
http://www.petefinnigan.com/Advisory_CPU_Oct_2008.htm

Application Security, Inc:
http://www.appsecinc.com/resources/alerts/oracle/2008-08.shtml
http://www.appsecinc.com/resources/alerts/oracle/2008-09.shtml
http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml
http://www.appsecinc.com/resources/alerts/oracle/2008-11.shtml

Deep Links
Links available in Customer Area