----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

International Partner Manager - Project Sales in the IT-Security
Industry:
http://corporate.secunia.com/about_secunia/64/

----------------------------------------------------------------------

TITLE:
Oracle Products Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31087

VERIFY ADVISORY:
http://secunia.com/advisories/31087/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Exposure of sensitive information, Privilege
escalation, DoS, System access, Unknown

WHERE:
>From remote

SOFTWARE:
Oracle9i Database Standard Edition
http://secunia.com/product/358/
Oracle9i Database Enterprise Edition
http://secunia.com/product/359/
Oracle9i Application Server
http://secunia.com/product/443/
Oracle Times-Ten In-Memory Database 7.x
http://secunia.com/product/19313/
Oracle PeopleSoft Enterprise Tools 8.x
http://secunia.com/product/9411/
Oracle PeopleSoft Enterprise Customer Relationship Management (CRM)
9.x
http://secunia.com/product/14815/
Oracle Hyperion Performance Suite 8.x
http://secunia.com/product/19315/
Oracle Hyperion Business Intelligence Plus 9.x
http://secunia.com/product/19314/
Oracle Enterprise Manager 10.x
http://secunia.com/product/2565/
Oracle E-Business Suite 12.x
http://secunia.com/product/13979/
Oracle E-Business Suite 11i
http://secunia.com/product/442/
Oracle Database 11.x
http://secunia.com/product/18050/
Oracle Database 10.x
http://secunia.com/product/3387/
Oracle Application Server 10g
http://secunia.com/product/3190/
BEA WebLogic Server 9.x
http://secunia.com/product/5822/
BEA WebLogic Server 8.x
http://secunia.com/product/1360/
BEA WebLogic Server 7.x
http://secunia.com/product/754/
BEA WebLogic Server 6.x
http://secunia.com/product/753/
BEA WebLogic Server 10.x
http://secunia.com/product/17671/
BEA WebLogic Express 9.x
http://secunia.com/product/5823/
BEA WebLogic Express 10.x
http://secunia.com/product/17672/
BEA WebLogic Express 7.x
http://secunia.com/product/1282/
BEA WebLogic Express 8.x
http://secunia.com/product/1843/

DESCRIPTION:
Multiple vulnerabilities have been reported for various Oracle
products. Some vulnerabilities have unknown impacts while others can
be exploited by malicious, local users to gain escalated privileges,
by malicious users to cause a DoS (Denial of Service), disclose
sensitive information, gain escalated privileges, or compromise a
vulnerable system, and by malicious people to bypass certain security
restrictions or to cause a DoS.

1) An unspecified error exists in Oracle HTTP Server.

This is related to:
SA24373

2) A NULL-pointer dereference error in Oracle Internet Directory can
be exploited to cause a DoS by sending a specially crafted LDAP
request to port 389/TCP or port 636/TCP.

3) A boundary error in the DBMS_AQELM package in Oracle Database can
be exploited to cause a buffer overflow by passing an overly large
string as a parameter to a procedure.

Successful exploitation of this vulnerability may allow execution of
arbitrary code

4) An error due to use of an untrusted library path in a setuid root
program can be exploited to gain root privileges.

Successful exploitation of this vulnerability requires access to the
database owner account (typically "oracle") or being a member of the
oracle installation group (typically "oinstall"). 

5) Input to the "SHOW" procedure within the "WWV_RENDER_REPORT"
package is not properly sanitised before being used. This can be
exploited to manipulate PLSQL statements by injecting certain PLSQL
code.

Successful exploitation allows to gain full control of a backend
Oracle database server via the front end web server.

6) An unspecified vulnerability in WebLogic Server within the
ForeignJMS component and in the WebLogic console or server log can be
exploited to disclose sensitive information.

7) Some unspecified vulnerabilities in WebLogic Server within in the
Console/WLST can be exploited to gain escalated privileges.

8) An unspecified vulnerability in WebLogic Server within the
WebLogic plug-ins for Apache, Sun and IIS Web servers can be
exploited to disclose sensitive information.

9) An unspecified vulnerability in WebLogic Server within the
processing of JSP pages can be exploited to disclose sensitive
information.

10) An unspecified vulnerability in WebLogic Server within the UDDI
Explorer can be exploited to compromise a vulnerable system.

11) An unspecified vulnerability in WebLogic Server can be exploited
to cause a DoS.

The remaining vulnerabilities are caused due to unspecified errors.
No more information is currently available.

The vulnerabilities are reported in the following products and
versions:
* Oracle Database 11g, version 11.1.0.6
* Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3,
10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
* Oracle TimesTen In-Memory Database version 7.0.3.0.0
* Oracle Application Server 10g Release 3 (10.1.3), versions
10.1.3.1.0, 10.1.3.3.0
* Oracle Application Server 10g Release 2 (10.1.2), versions
10.1.2.2.0, 10.1.2.3.0
* Oracle Application Server 10g (9.0.4), version 9.0.4.3
* Oracle Hyperion BI Plus version 9.2.0.3, 9.2.1.0,and 9.3.1.0
* Oracle Hyperion Performance Suite version 8.3.2.4, and 8.5.0.3
* Oracle E-Business Suite Release 12, version 12.0.4
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* Oracle Enterprise Manager Database Control 11i version 11.1.0.6
* Oracle Enterprise Manager Database Control 10g Release 2, versions
10.2.0.2, 10.2.0.3, 10.2.0.4
* Oracle Enterprise Manager Database Control 10g Release 1, version
10.1.0.5
* Oracle Enterprise Manager Grid Control 10g Release 1, versions
10.1.0.5, 10.1.0.6
* Oracle PeopleSoft Enterprise PeopleTools versions 8.48.17, 8.49.11
* Oracle PeopleSoft Enterprise CRM version 8.9, 9.0
* Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released
through MP1
* Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0, 9.1, 9.2
released through MP3
* Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released
through SP6
* Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released
through SP7
* Oracle WebLogic Server (formerly BEA WebLogic Server) 6.1 released
through SP7

SOLUTION:
Apply patches (see the vendor's advisory).

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
* Flavio Casetta of Yocoya
* Esteban Martinez Fayo of Application Security, Inc.
* Johannes Greil, SEC Consult
* guyp, Sentrigo
* Joxean Koret
* Alexander Kornbrust, Red Database Security
* Stephen Kost, Integrigy
* Dave Lewis
* David Litchfield, NGS Software
* Hirofumi Oka, JPCERT/CC Vulnerability Handling Team
* Tanel Poder
* Alexandr Polyakov, Digital Security
* Andrea Purificato
* Dave Wichers, Aspect Security

ORIGINAL ADVISORY:
Oracle:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2008.html

Oracle / BEA:
https://support.bea.com/application_content/product_portlets/securityadvisories/2782.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2790.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2789.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2785.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2786.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2791.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2792.html

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=725
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=726
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=727

David Litchfield:
http://archives.neohapsis.com/archives/fulldisclosure/2008-07/0240.html

OTHER REFERENCES:
SA24373:
http://secunia.com/advisories/24373/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------