Status Tracking Note JVNTR-2009-02

Oracle Updates for Multiple Vulnerabilities - January 2009 (TA09-015A)

Overview

Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include remote execution of arbitrary code, information disclosure, and denial of service.
Event Information
Date (UTC)Description
2009-01-15 19:46 US-CERT
TA09-015A: Oracle Updates for Multiple Vulnerabilities
Via US-CERT Mailing List
2009-01-14 Bugtraq
Oracle TimesTen 7.XX Remote Format String for Inguma
login.php/common.php Vulnerability (ZDI-09-004)
Vulnerability Proof Of Concept
#Cid: CVE-2008-5440.py
#Cid: COraTtFmt.py.txt
#Tested: Oracle TimesTen 7.03
#Tested: cpe:/a:oracle:timesten_in-memory_database:7.0.3
2009-01-14 Bugtraq
Oracle Secure Backup remote code execution for Inguma
login.php/common.php Vulnerability (ZDI-09-003)
Vulnerability Proof Of Concept
#Cid: COraSecBackup.py.txt
2009-01-13 21:10 Oracle
Oracle Critical Patch Update Advisory - January 2009
2009-01-13 20:08 US-CERT
Oracle Releases Critical Patch Update for January 2009
US-CERT Current Activity
Oracle has released their Critical Patch Update for January 2009 to address 41 vulnerabilities across several products.
2009-01-13 19:25 SANS Internet Storm Center
The Oracle Patches are Coming! The Oracle Patches are Coming!
Oracle has posted a pre-release announcement for their January patch release and it looks to be big.
2009-01-13 Fortinet Inc.
FGA-2009-02: Fortinet discovers multiple vulnerabilities in Oracle Secure Backup
2008-11-05 Full-disclosure
FSC20090113-10: Assurent VR - Oracle BEA WebLogic Server Apache Connector Buffer Overflow
Vulnerability Reported (CVE-2008-5457)
A remotely exploitable vulnerability has been discovered in the Apache Connector component of Oracle BEA WebLogic Server. Specifically, the vulnerability is due to a boundary error when processing incoming HTTP requests and can lead to a buffer overflow condition. This boundary error can lead to a Denial of Service (DoS) condition for the Apache HTTP server.
2008-09-25 SecNiche Security
Oracle EBusiness Suite Sensitive Information Disclosure Vulnerability
Vulnerability Reported (CVE-2008-5446)
2008-08-16 Full-disclosure
Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server 10g (10.1.3.1.0) Oracle HTTP Server
Vulnerability Reported (CVE-2008-2938)
2008-07-18 iDefense
Oracle Secure Backup Administration Server login.php Command Injection Vulnerability
login.php/common.php Vulnerability (CVE-2008-4006, CVE-2008-5448)
Vulnerability Reported
The first vulnerability is in "php/login.php". By making a login request with a specially crafted cookie value, an attacker can execute arbitrary code on the server.
The second vulnerability is in "php/common.php". This function is called from the "login.php" page. A variable is used to specify a command to be run. An attacker can supply any shell command for this variable and it will be executed in the context of the web server process.
2008-06-23 NGSSoftware
#NISR13012009: Trigger Abuse of MDSYS.SDO_TOPO_DROP_FTBL in Oracle 10g R1 and R2
Vulnerability Reported (CVE-2008-3979)
Oracle has just released a fix for a flaw that, when exploited, allows a low privileged authenticated database user to gain MDSYS privileges. This can be abused by an attacker to perform actions as the MDSYS user.
2008-04-07 Zero Day Initiative (ZDI)
ZDI-09-004: Oracle TimesTen evtdump Remote Format String Vulnerability
Vulnerability Reported
The specific flaw exists in the evtdump CGI module, which is used to write to an internal log file. The parameter 'msg' does not properly sanitize format string tokens and can be exploited to execute arbitrary code.
2008-03-24 iDefense
Oracle Database 10g R2 Summary Advisor Arbitrary File Rewrite Vulnerability
Arbitrary File Rewrite Vulnerability (CVE-2008-3997)
Vulnerability Reported
The vulnerability exists in a function that allows a user with an authenticated session to create any file or rewrite any files to which the database account has access.
2007-07-13 Zero Day Initiative (ZDI)
ZDI-09-003: Oracle Secure Backup exec_qr() Command Injection Vulnerability
Vulnerability Reported
The specific flaw exists within the routine exec_qr() defined in the web script login.php. The user-supplied variable $rbtool is improperly sanitized and later passed through a call to popen(), this can result in remote pre-authentication command injection.
2007-03-08 iDefense
Oracle Secure Backup Administration Server login.php Command Injection Vulnerability
login.php/common.php Vulnerability (CVE-2008-5449)
Vulnerability Reported
The vulnerability is in a function of common.php which is called from the login.php page. The script fails to sanitize the input when verifying the user has permission to use the service.
Reference
Date first published (UTC): 2009-01-21T05:38+00:00
Date last updated (UTC): 2009-01-21T05:38+00:00
Valid HTML 4.01!