Oracle Critical Patch Update July 2008 Pre-Release Analysis

11 Jul

Oracle Critical Patch Update July 2008 Pre-Release Analysis

Here is a brief analysis of the pre-release announcement for the upcoming July 2008 Oracle Critical Patch Update (CPU) -

  • Overall, 45 security vulnerabilities are fixed in this CPU, which is an average number well within the range of previous CPUs (Apr-08=41, Jan-08=26, Oct-07=51, Jul-07=45, Apr-07=36, Jan-07=51, Oct-06=101, Jul-06=62, Apr-06=34, Jan-06=80).
  • This is the first CPU that includes fixes for BEA WebLogic, Hyperion BI, and TimesTen Database.
  • The product and vulnerability mix appears to be similar to previous CPUs.  All CPU supported Oracle Database, Oracle Application Server, and Oracle E-Business Suite versions are included.  The list of supported versions is getting very short and should be carefully reviewed to determine if version upgrades are required prior to applying the CPU security patches -
        • Database = 9.2.0.8, 10.1.0.5, 10.2.0.3, 10.2.0.4, and 11.1.0.6 for major platforms
        • Application Server = 9.0.4.3, 10.1.2, and 10.1.3
        • E-Business Suite = 11.5.10.x, and 12.0.x
  • The major CPU version support changes for July 2008 are -
      • Database version 10.2.0.4 is included in the list of affected versions
      • Oracle E-Business Suite 11i version 11.5.9 is no longer supported for CPUs

Oracle Database

  • There are 11 database vulnerabilities and none are remotely exploitable without authentication, which is consistent with previous CPUs.  Usually, the vast majority of database vulnerabilities require authentication.  However, it is highly likely a portion of these vulnerabilities can be exploited using only PUBLIC privileges accessible by all database accounts.
  • The vulnerabilities of most interest are in the Core RDBMS and Authentication components, but the Database Scheduler vulnerability could be interesting.
  • At least one of the database security vulnerabilities has a CVSS 2.0 metric of 6.5, which for database vulnerabilities should be considered high risk.  This typically means anyone with a valid database session is able to compromise the entire database, but is unable to achieve root operating system access.
  • The 2 Oracle 11g vulnerabilities discovered by Integrigy are low risk and are not be directly exploitable, but may allow authentication security mis-configurations to go undetected.

Oracle Application Server

  • There are 9 new Oracle Application Server vulnerabilities, all of which are remotely exploitable without authentication.  In previous CPUs, the majority of Oracle Application Server vulnerabilities have tended to be remotely exploitable without authentication.  The vulnerabilities are in Hyperion BI Plus, Oracle HTTP Server, Oracle Internet Directory, and Oracle Portal.
  • The Oracle HTTP Server vulnerabilities may be related to recent Apache HTTP Server and OpenSSL fixes.
  • The Oracle Portal vulnerability may be related to CVE-2008-2138, which is an access restriction bypass issue in the WebDav component of Oracle Portal.

Oracle E-Business Suite 11i and R12

  • There are 6 new Oracle E-Business Suite 11i and R12 vulnerabilities and none are remotely exploitable without authentication.  However, since iStore allows for customer self-registration, most likely the iStore vulnerability (or vulnerabilities) can be readily exploited by an unprivileged user.
  • For the Oracle E-Business Suite 11i, only 11.5.10.x is now supported for CPUs and requires ATG_PF.H RUP 5 or RUP 6 be installed.
  • The 2 Oracle E-Business Suite 11i/R12 vulnerabilities discovered by Integrigy are low risk and are in the Oracle Application Object Library (AOL/FND).

Planning Impact

  • As with all previous CPUs, this quarter's security patches should be deemed critical and you should adhere to the established procedures and timing used for previous CPUs.

Correction: This post has been edited to update the supported Oracle E-Business Suite 11i versions.  The original Oracle pre-release and Rev1 of the advisory incorrectly stated only 11.5.10.2 was supported - 11.5.10 and 11.5.10.1 are still supported.

 Share this post