Oracle releases 87 security fixes
Posted on 18 July 2012.
The Oracle Critical Patch Update (CPU) Advisory for July 2012 contains 87 security fixes for various products across their portfolio. This advisory is a bit of déjà vu from the April 2012 advisory that contained 88 fixes and Oracle JRockit had the top CVSS 2.0 Base Score of 10.0, as it does this time round.

From an exploitation perspective, a 10.0 base score is a perfect storm because it can be remotely accessed over a network, has low complexity and results in complete compromise of confidentially, integrity and availability of a system running the vulnerable software.

Here is a quick list of the high impact vulnerabilities that require no credentials:
  • CVE-2012-3135 - Oracle JRockit - CVSS 10.0
  • CVE-2012-1740 - Oracle Application Express Listener - CVSS 7.8
  • CVE-2011-3192 - Oracle Secure Backup Apache Component - CVSS 7.8
  • CVE-2012-1737 - Oracle Enterprise Manager Grid Control - CVSS 6.8
  • CVE-2012-1731 - Oracle Siebel CRM - CVSS 6.8
There is a local (not network-based) vulnerability CVE-2012-3126, which affects Solaris Cluster via the Apache Tomcat Agent, which would result in total compromise of a system.

There are three Solaris patches for CVE-2012-3120, CVE-2008-4609, CVE-2012-3125, which are all denial-of-services vulnerabilities. These types of vulnerabilities could definitely adversely affect an organization through lost earnings, productivity and customer confidence.

Enterprises should be able to understand the cadence and predictability of Oracle's CPU Advisories so that they can build countermeasures into their security programs to tackle network-based vulnerabilities. Organizations should realize that these types of high-impact network-based vulnerabilities exist whether they are known or not.

Organizations should build their networks for resilience to these attacks, regardless of the availability of a patch or news of a zero-day attack.

Some common-sense network security concepts such as network access control list can mitigate the risk of Internet-based attacks. Organizations should also use these types of controls internally to prevent exploitation from internal assets, which at times could be under the control of attackers.

In order to do this, organizations need to understand how each product communicates on the network by protocol and ports to create the relevant network-based security controls. Simply put, network access to sensitive assets such as the Oracle products, should be on a ‘need-to-access’ type basis.


Author: Marcus Carey, security researcher at Rapid7.





Spotlight

Operation Pawn Storm: Varied targets and attack vectors, next-level spear-phishing tactics

Posted on 23 October 2014.  |  Targets of the spear phishing emails included staff at the Ministry of Defense in France, in the Vatican Embassy in Iraq, military officials from a number of countries, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //