Oracle July 2017 Critical Patch Update addresses record-breaking 308 issues
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-10137 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). NVD description · AI analysis pending | 10.0 | 4% |
| — | ||
| CVE-2017-10244 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). NVD description · AI analysis pending | 5.3 | 2% |
| — | ||
| CVE-2017-3632 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: CDE Calendar). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3632 is assigned to the "EASYSTREET" vulnerability. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 | 4% |
| — |
Full article415 words · extracted from securityaffairs.com · click to collapse
Oracle issued its quarterly update, the July 2017 Critical Patch Update (CPU), that addresses 308 security vulnerabilities, 30 of them are rated as critical.
This July 2017 Critical Patch Update (CPU) addressed security vulnerabilities in 22 Oracle products, including Oracle Database Server, Oracle Enterprise Manager, Oracle Fusion Middleware, Oracle Hyperion, Oracle E-Business Suite, Oracle Industry Applications (Communications, Retail, and Hospitality), Oracle Primavera, Oracle Sun Products, Oracle Java SE, and Oracle MySQL.
27 out of 308 vulnerabilities addressed by Oracle were classified as critical flaws, they were rated with a CVSS score between 9.0 and 10.0, only one bug was rated 10. More than half of the issues addressed by the security patched can be exploited remotely without authentication.
One of the issues is a remote privilege escalation flaw tracked as CVE-2017-3632 in the Solaris CDE Calendar component. Other Solaris vulnerabilities could be exploited to power DDoS attacks or to allow unauthorized data alterations.
The Oracle Security update also addressed ten critical vulnerabilities in Java SE, nine of them rated 9.6. According to Oracle, 28 of 32 Java flaws “may be remotely exploitable without authentication”.
The CPU addressed 30 vulnerabilities in Oracle MySQL, 9 of them are remotely exploitable.
Experts are particularly concerned for about 30 vulnerabilities affecting PeopleSoft, 20 of them can be exploited over the network without user credentials.
The updates also fixed a critical flaw in Oracle WebLogic rated 10 and tracked as CVE-2017-10137 which could be exploited by hackers to elevate privileges.
One of the most severe issued in the E-Business Suite was an Information Disclosure flaw tracked as CVE-2017-10244. The issued can be exploited by an attacker “to exfiltrate sensitive business data without requiring a valid user account in the system,”
“This vulnerability is especially critical as an attacker would only need a web browser and network access to the EBS system to perform it. Any number of critical documents could be stored in the system including invoices, purchase orders, HR information and design documents to start. Even systems in DMZ mode do not ensure these systems are not vulnerable,” said Juan Perez-Etchegoyen, Onapsis CTO.
The huge number of vulnerabilities addressed by Oracle in the July 2017 Critical Patch Update (CPU) demonstrates how large is our surface of attack. Each flaw could be potentially exploited by attackers to break into one of the Oracle solutions.
Apply the security updates as soon as possible.
[adrotate banner=”9″]
(Security Affairs – July 2017 Critical Patch Update (CPU),Oracle)
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/61163/hacking/oracle-july-2017-critical-patch.html