Some vulnerabilities have been reported in several Oracle BEA products, which can be exploited by malicious people to cause a DoS (Denial of Service), disclose sensitive information, bypass certain security restrictions, manipulate certain data, conduct cross-site scripting attacks, or compromise a user's system.

1) Multiple vulnerabilities in JRockit can be exploited by malicious people to cause a DoS, conduct spoofing attacks, disclose sensitive information, bypass certain security restrictions, or compromise a user's system.

For more information:
SA35853
SA36159

2) An error in WebLogic Portal can be exploited to manipulate certain data.

3) An error in WebLogic Server related to WLS Console can be exploited to manipulate certain data.

4) Certain unspecified input passed to the WebLogic Server administration console is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in the following products and versions:
* Oracle WebLogic Server 10.0 through MP1, and 10.3
* Oracle WebLogic Server 9.0 GA, 9.1 GA, and 9.2 through 9.2 MP3
* Oracle WebLogic Server 8.1 through 8.1 SP5
* Oracle WebLogic Server 7.0 through 7.0 SP6
* Oracle WebLogic Portal, versions 8.1 through 8.1 SP6, 9.2 through 9.2 MP3, 10.0 through 10.0MP1, 10.2 through 10.2MP1, and 10.3 through 10.3.1
* Oracle JRockit R27.6.4 and earlier (JDK/JRE 6, 5, 1.4.2)

Solution
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by
4) Luka Treiber of ACROS Security

For the remaining vulnerabilities fixed in the October Critical Patch Update, the vendor credits:
* Yaniv Azaria of Imperva, Inc.
* Cesar Cerrudo of Argeniss
* Deniz Cevik of Intellect
* Joxean Koret of iSIGHT Partners Global Vulnerability Partnership
* Alexander Kornbrust of Red Database Security
* David Litchfield of NGS Software
* Ryan Permeh of McAfee Avert labs
* Guy Pilosof of Sentrigo
* Aviv Pode of Sentrigo
* Alexandr Polyakov of Digital Security
* Pawel Romanek of Asseco Business Solutions
* Amichai Shulman of Imperva, Inc.
* Rajat Swarup
* Laszlo Toth
* Wei Wang of McAfee Avert labs
* Dennis Yurichev

Changelog
Further details available to Secunia VIM customers

Original Advisory
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html

ACROS Security:
http://www.acrossecurity.com/aspr/ASPR-2009-10-30-1-PUB.txt

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers