Oracle patches dangerous WebLogic flaw, critical database holes

Oracle Corp. plugged a severe flaw in the Apache plug-in for its WebLogic Server and addressed vulnerabilities in more than two dozen other products as part of its quarterly Critical Patch Update. Oracle said its security update contained patches for 36 flaws.

Oracle released six fixes to address vulnerabilities for the former BEA product line. Five of the vulnerabilities could be remotely exploited by an attacker. Eric Maurice, manager of security in Oracle's Global Technology Business Unit, warned customers that the most severe vulnerability was located in the Apache plug-in for Oracle WebLogic Server. The flaw could be exploited remotely by an attacker and was given a Common Vulnerability Scoring System (CVSS) base score of 10. The attacker doesn't have to be authenticated and could gain complete control of the server.

The CPU includes 15 new security vulnerability fixes for the Oracle Database. The highest CVSS score was 6.5.One of the more critical vulnerabilities is located in Oracle's core relational database management system and may be remotely exploited without authentication. The vulnerability exploits the network protocol between the Oracle client software and the Oracle server. It abuses the proxy account mechanism in the Oracle server. The flaw affects Oracle database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.2.

Compared to previous CPU's, the October release addressed fewer vulnerabilities, said Amichai Shulman, chief technology officer of Foster City, Calif.-based Imperva. In July, Oracle released 45 database and application fixes. Many of the database fixes released this month repair SQL injection vulnerabilities, he said.

"While their CVSS scores are not as high, I do think that they are actually more threatening than their scores suggest," Shulman said.

Oracle also plugged holes in its Publish and iPublish packages, which implement some of the services required to control and audit changes to specific columns in the database. The flaws affect Oracle database 10.1.0.5, 10.2.0.4, 11.1.0.6.

"These packages have been patched over and over again at least three times in the past two years," Shulman said.

In addition, six new security updates were released for Oracle Application Server. Two updates to Oracle Portal could be remotely exploited without authentication, Oracle said. In addition, four security updates were released to address issues in parts of the Oracle E-Business Suite. Problems in the Oracle Applications Technology Stack and the iSupplier Portal could be remotely exploited without authentication. Both vulnerabilities were given a medium-risk CVSS score of 5.0.

Five security vulnerability fixes were released by Oracle for its PeopleSoft Enterprise and JD Edwards Enterprise One products. Oracle said two of the vulnerabilities could be remotely exploited without authentication.