The Oracle Critical Patch Update (CPU) Advisory for July 2012 contains 87 security fixes for various products across their portfolio. This advisory is a bit of déjà vu from the April 2012 advisory that contained 88 fixes and Oracle JRockit had the top CVSS 2.0 Base Score of 10.0, as it does this time round.

From an exploitation perspective, a 10.0 base score is a perfect storm because it can be remotely accessed over a network, has low complexity and results in complete compromise of confidentially, integrity and availability of a system running the vulnerable software.

Here is a quick list of the high impact vulnerabilities that require no credentials:

• CVE-2012-3135 - Oracle JRockit - CVSS 10.0
• CVE-2012-1740 - Oracle Application Express Listener - CVSS 7.8
• CVE-2011-3192 - Oracle Secure Backup Apache Component - CVSS 7.8
• CVE-2012-1737 - Oracle Enterprise Manager Grid Control - CVSS 6.8
• CVE-2012-1731 - Oracle Siebel CRM - CVSS 6.8

There is a local (not network-based) vulnerability CVE-2012-3126, which affects Solaris Cluster via the Apache Tomcat Agent, which would result in total compromise of a system.

There are three Solaris patches for CVE-2012-3120, CVE-2008-4609, CVE-2012-3125, which are all denial-of-services vulnerabilities. These types of vulnerabilities could definitely adversely affect an organization through lost earnings, productivity and customer confidence.

Enterprises should be able to understand the cadence and predictability of Oracle's CPU Advisories so that they can build countermeasures into their security programs to tackle network-based vulnerabilities. Organizations should realize that these types of high-impact network-based vulnerabilities exist whether they are known or not.

Organizations should build their networks for resilience to these attacks, regardless of the availability of a patch or news of a zero-day attack.

Some common-sense network security concepts such as network access control list can mitigate the risk of Internet-based attacks. Organizations should also use these types of controls internally to prevent exploitation from internal assets, which at times could be under the control of attackers.

In order to do this, organizations need to understand how each product communicates on the network by protocol and ports to create the relevant network-based security controls. Simply put, network access to sensitive assets such as the Oracle products, should be on a ‘need-to-access’ type basis.


Author: Marcus Carey, security researcher at Rapid7.