Oracle E-Business Suite Critical Patch Update (CPU) Planning for 2016

Oracle E-Business Suite, Oracle Critical Patch Updates

With the start of the new year, it is now time to think about Oracle Critical Patch Updates for 2016. Oracle releases security patches in the form of Critical Patch Updates (CPU) each quarter (January, April, July, and October). These patches include important fixes for security vulnerabilities in the Oracle E-Business Suite and its technology stack. The CPUs are only available for certain versions of the Oracle E-Business Suite and Oracle Database, therefore, advanced planning is required to ensure supported versions are being used and potentially mitigating controls may be required when the CPUs can not be applied in a timely manner.

For 2016, CPUs for Oracle E-Business Suite will become a significant focus as a large number of security vulnerabilities for the Oracle E-Business Suite will be fixed. The January 2016 CPU for the Oracle E-Business Suite (EBS) will include 78 security fixes for a wide range of security bugs with many being high risk such as SQL injection in web facing self-service modules. Integrigy anticipates the next few quarters will have an above average number of EBS security fixes (average is 7 per CPU since 2005). This large number of security bugs puts Oracle EBS environments at significant risk as many of these bugs will be high risk and well publicized.

Supported Oracle E-Business Suite Versions

Starting with the April 2016 CPU, only 12.1 and 12.2 will be fully supported for CPUs moving forward. 11.5.10 CPU patches for April 2016, July 2016, and October 2016 will only be available to customers with an Advanced Customer Support (ACS) contract. There will be no 11.5.10 CPU patches after October 2016. CPU support for 12.0 ended as of October 2015.

11.5.10 Recommendations

When possible, the recommendation is to upgrade to12.1 or 12.2.
Obtaining an Advanced Customer Support (ACS) contract is a short term (until October 2016) solution, but is an expensive option.
An alternative to applying CPU patches is to use Integrigy's AppDefend, an application firewall for Oracle EBS, in proxy mode which blocks EBS web security vulnerabilities. AppDefend provides virtual patching and can effectively replace patching of EBS web security vulnerabilities.

In order to mitigate some mod_plsql security vulnerabilities, all Oracle EBS 11i environments should look at limiting the enabled mod_plsql web pages. The script /patch/115/sql/txkDisableModPLSQL.sql can be used to limit the allowed pages listed in FND_ENABLED_PLSQL. This script was introduced in 11i.ATG_PF.H and the most recent version is in 11i.ATG_PF.H.RUP7. This must be thoroughly tested as it may block a few mod_plsql pages used by your organization. Review the Apache web logs for the pattern '/pls/' to see what mod_plsql pages are actively being used. This fix is included and implemented as part of the January 2016 CPU.

12.0 Recommendations

As no security patches are available for 12.0, the recommendation is to upgrade to 12.1 or 12.2 when possible.
If upgrading is not feasible, Integrigy's AppDefend, an application firewall for Oracle EBS, provides virtual patching for EBS web security vulnerabilities as well as blocks common web vulnerabilities such as SQL injection and cross-site scripting (XSS). AppDefend is a simple to implement and cost-effective solution when upgrading EBS is not feasible.

12.1 Recommendations

12.1 is supported for CPUs through October 2019 for implementations where the minimum baseline is maintained. The current minimum baseline is the 12.1.3 Application Technology Stack (R12.ATG_PF.B.delta.3). This minimum baseline should remain consistent until October 2019, unless a large number of functional module specific (i.e., GL, AR, AP, etc.) security vulnerabilities are discovered.
For organizations where applying CPU patches is not feasible within 30 days of release or Internet facing self-service modules (i.e., iSupplier, iStore, etc.) are used, AppDefend should be used to provide virtual patching of known, not yet patched web security vulnerabilities and to block common web security vulnerabilities such as SQL injection and cross-site scripting (XSS).

12.2 Recommendations

12.2 is supported for CPUs through July 2021 as there will be no extended support for 12.2. The current minimum baseline is 12.2.3 plus roll-up patches R12.AD.C.Delta.7 and R12.TXK.C.Delta.7. Integrigy anticipates the minimum baseline will creep up as new RUPs (12.2.x) are released for 12.2. Your planning should anticipate the minimum baseline will be 12.2.4 in 2017 and 12.2.5 in 2019 with the releases of 12.2.6 and 12.2.7. With the potential release of 12.3, a minimum baseline of 12.2.7 may be required in the future.
For organizations where applying CPU patches is not feasible within 30 days of release or Internet facing self-service modules (i.e., iSupplier, iStore, etc.) are used, AppDefend should be used to provide virtual patching of known, not yet patched web security vulnerabilities and to block common web security vulnerabilities such as SQL injection and cross-site scripting (XSS).

EBS Database Recommendations

As of the October 2015 CPU, the only CPU supported database versions are 11.2.0.4, 12.1.0.1, and 12.1.0.2. 11.1.0.7 and 11.2.0.3 CPU support ended as of July 2015. The final CPU for 12.1.0.1 will be July 2016.
When possible, all EBS environments should be upgraded to 11.2.0.4 or 12.1.0.2, which are supported for all EBS versions including 11.5.10.2.
If database security patches (SPU or PSU) can not be applied in a timely manner, the only effective mitigating control is to strictly limit direct database access. In order to restrict database access, Integrigy recommends using the EBS feature Managed SQLNet Access, Oracle Connection Manager, network restrictions and firewall rules, and/or terminal servers and bastion hosts.
Regardless if security patches are regularly applied or not, general database hardening such as changing database passwords, optimizing initialization parameters, and enabling auditing should be done for all EBS databases.