Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
BID:24887
Info
Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
| Bugtraq ID: | 24887 |
| Class: | Unknown |
| CVE: |
CVE-2007-3855 CVE-2007-3865 CVE-2007-3866 CVE-2007-3867 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 12 2007 12:00AM |
| Updated: | Jul 24 2007 08:16PM |
| Credit: | Esteban Martinez Fayo of Application Security, Inc.; Jack Kanter and Stephen Kost of Integrigy; Guy Karlebach of Imperva; Joxean Koret; Alexander Kornbrust of Red Database Security GmbH; Michael Krax; and David Litchfield and Paul M. Wright of Next Generat |
| Vulnerable: |
Oracle Secure Enterprise Search 10g Release 1 10.1.8 Oracle Secure Enterprise Search 10g Release 1 10.1.6 Oracle PeopleSoft Enterprise PeopleTools 8.49 Oracle PeopleSoft Enterprise PeopleTools 8.48 Oracle PeopleSoft Enterprise PeopleTools 8.47 Oracle PeopleSoft Enterprise PeopleTools 8.22 Oracle PeopleSoft Enterprise Human Capital Management 9.0 Oracle PeopleSoft Enterprise Human Capital Management 8.9 Oracle PeopleSoft Enterprise Customer Relationship Manage 9.0 Oracle PeopleSoft Enterprise Customer Relationship Manage 8.9 Oracle Oracle9i Standard Edition 9.2 .8DV Oracle Oracle9i Standard Edition 9.2 .8 Oracle Oracle9i Standard Edition 9.2 .7 Oracle Oracle9i Standard Edition 9.0.1 .5 FIPS Oracle Oracle9i Personal Edition 9.2 .8DV Oracle Oracle9i Personal Edition 9.2 .8 Oracle Oracle9i Personal Edition 9.2 .7 Oracle Oracle9i Personal Edition 9.0.1 .5 FIPS Oracle Oracle9i Enterprise Edition 9.2 .8DV Oracle Oracle9i Enterprise Edition 9.2 .8.0 Oracle Oracle9i Enterprise Edition 9.2 .7.0 Oracle Oracle9i Enterprise Edition 9.0.1 .5 FIPS Oracle Oracle9i Application Server 1.0.2 .2 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2 .2 Oracle Oracle10g Standard Edition 10.1 .5 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2 .2 Oracle Oracle10g Personal Edition 10.1 .5 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 10.2 .2 Oracle Oracle10g Enterprise Edition 10.1 .5 Oracle Oracle10g Application Server 10.1.3 .3.0 Oracle Oracle10g Application Server 10.1.3 .2.0 Oracle Oracle10g Application Server 10.1.3 .1.0 Oracle Oracle10g Application Server 10.1.3 .0.0 Oracle Oracle10g Application Server 10.1.2 .2.0 Oracle Oracle10g Application Server 10.1.2 .1.0 Oracle Oracle10g Application Server 10.1.2 .0.2 Oracle Oracle10g Application Server 10.1.2 .0.1 Oracle E-Business Suite 12 12.0.1 Oracle E-Business Suite 12 12.0 Oracle E-Business Suite 11i 11.5.10 CU2 Oracle E-Business Suite 11i 11.5.10 Oracle E-Business Suite 11i 11.5.9 Oracle E-Business Suite 11i 11.5.8 Oracle Collaboration Suite Release 1 10.1.2 Oracle Application Server 10g 9.0.4 .3 Oracle Application Express 2.2 Oracle Application Express 2.1 Oracle Application Express 2.0 Oracle Application Express 1.5 HP Oracle for OpenView for Linux LTU Service Bureaus 0 HP Oracle for OpenView for Linux LTU 0 HP Oracle for OpenView 9.1.1 HP Oracle for OpenView 8.1.7 HP Oracle for OpenView 9.2 |
| Not Vulnerable: | |
Discussion
Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well.
The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise.
Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well.
The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise.
Exploit / POC
Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
Some of these issues may not require specific exploit code.
The following exploits are available:
Some of these issues may not require specific exploit code.
The following exploits are available:
Solution / Fix
Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
Solution:
Oracle has released a Critical Patch Update (July 2007) to address these issues. Please see the update for information on obtaining and applying appropriate patches.
Solution:
Oracle has released a Critical Patch Update (July 2007) to address these issues. Please see the update for information on obtaining and applying appropriate patches.
References
Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
References:
References:
- [VIM] There is no AS02 in Oracle CPU Jul 2007 (Steven M. Christey)
- Oracle Critical Patch Update �?? July 2007 Oracle E-Business Suite 11i Impact (Integrigy)
- Oracle Critical Patch Update July 2007 Version Support Matrix (Integrigy)
- Oracle Homepage (Oracle)
- Oracle Database Buffer overflow vulnerabilities in procedure DBMS_DRS.GET_PROPER ([email protected])
- Oracle Database Buffer overflows and Denial of service vulnerabilities in public ([email protected])
- Oracle E-Business Suite - Multiple Vulnerabilities (Integrigy)
- Oracle Security: Insert / Update / Delete Data via Views ([email protected])
- Oracle Security: SQL Injection in APEX CHECK_DB_PASSWORD ([email protected])
- Oracle Security: SQL Injection in package DBMS_PRVTAQIS ([email protected])
- Oracle Critical Patch Update - July 2007 (Oracle)
- Oracle EBS - XSS Vulnerability (Imperva)