Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: Oracle Critical Patch Update October SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Oracle Critical Patch Update October

Oracle has just released their critical patch update http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html

Quite  a number of products are being patched also for those of you subject to PCI DSS there are a significant number of patches addressing issues with a CVSS score of 4 or higher, which must be patched under the standard.

They have also released a critical patch update for Java http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html 

The info in the Oracle bulletin is comprehensive and should allow you to identify what needs to be done fairly easily.  Both bulletins have the following wording in the work around section "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible." For most of us not new (at least not on the java side), but maybe a strong argument if you get pushback on patching.

Happy patching, as always test before you implement.

Mark H - shearwater
 

Mark

391 Posts
ISC Handler
I reported CVE-2012-3152 and CVE-2012-3153 to Oracle back in March and they just released a fix but from what I understand, they are only fixing future versions and not older ones. They said they would inform customers how to patch but I haven't seen any details.

The two vulnerabilities are trivial to exploit, one which allows you to use a web browser to grab files off of the system that the oracle account has access to. The other allows you to grab database passwords. All unauthenticated.

If you run Oracle Reports Servers it might be a good idea to make sure diagnostic output is disabled. That will mitigate the vulnerability.
@Miss_Sudo

12 Posts
Not seeing much news about this in the normal places (US-CERT, etc.), but this cycle also included 30 Java security holes.

I was first tipped off by this story:
https://krebsonsecurity.com/2012/10/critical-java-patch-plugs-30-security-holes/
@Miss_Sudo
42 Posts

Sign Up for Free or Log In to start participating in the conversation!