Oracle January 2008 Critical Patch Update Multiple Vulnerabilities

Bugtraq ID:	27229
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 10 2008 12:00AM
Updated:	Jan 30 2008 06:47PM
Credit:	The vendor credits the following with the discovery of these vulnerabilities: CERT/CC; Esteban Martinez Fayo of Application Security, Inc.; Pete Finnigan; Joxean Koret; Alexander Kornbrust of Red Database Security; Ali Kumcu of inTellectPro; David Litchfie
Vulnerable:	Oracle PeopleSoft Enterprise PeopleTools 8.49 Oracle PeopleSoft Enterprise PeopleTools 8.48 Oracle PeopleSoft Enterprise PeopleTools 8.47 Oracle PeopleSoft Enterprise PeopleTools 8.22 Oracle Oracle9i Standard Edition 9.2 .8DV Oracle Oracle9i Standard Edition 9.2 .8 Oracle Oracle9i Personal Edition 9.2 .8DV Oracle Oracle9i Personal Edition 9.2 .8 Oracle Oracle9i Enterprise Edition 9.2 .8DV Oracle Oracle9i Enterprise Edition 9.2 .8.0 Oracle Oracle11g Standard Edition One 11.1 6 Oracle Oracle11g Standard Edition 11.1 6 Oracle Oracle11g Enterprise Edition 11.1 6 Oracle Oracle10g Standard Edition 10.2 .3 Oracle Oracle10g Standard Edition 10.2 .2 Oracle Oracle10g Standard Edition 10.1 .5 Oracle Oracle10g Personal Edition 10.2 .3 Oracle Oracle10g Personal Edition 10.2 .2 Oracle Oracle10g Personal Edition 10.1 .5 Oracle Oracle10g Enterprise Edition 10.2 .3 Oracle Oracle10g Enterprise Edition 10.2 .2 Oracle Oracle10g Enterprise Edition 10.1 .5 Oracle Oracle10g Application Server 10.1.3 .3.0 Oracle Oracle10g Application Server 10.1.3 .2.0 Oracle Oracle10g Application Server 10.1.3 .1.0 Oracle Oracle10g Application Server 10.1.3 .0.0 Oracle Oracle10g Application Server 10.1.2 .2.0 Oracle Oracle10g Application Server 10.1.2 .1.0 Oracle Oracle10g Application Server 10.1.2 .0.2 Oracle Oracle10g Application Server 10.1.2 .0.1 Oracle Oracle10g Application Server 9.0.4 3 Oracle Enterprise Manager Grid Control 10g 10.1 6 Oracle Enterprise Manager Grid Control 10g 10.1 .5 Oracle Enterprise Manager Database Control 10g 10.2.0.3 Oracle Enterprise Manager Database Control 10g 10.2.0.2 Oracle Enterprise Manager Database Control 10g 10.1.0.5 Oracle E-Business Suite 12 12.0.3 Oracle E-Business Suite 12 12.0.2 Oracle E-Business Suite 12 12.0.1 Oracle E-Business Suite 12 12.0 Oracle E-Business Suite 11i 11.5.10 CU2 Oracle E-Business Suite 11i 11.5.10 Oracle E-Business Suite 11i 11.5.9 Oracle E-Business Suite 11i 11.5.8 Oracle Collaboration Suite 10g 10.1.2
Not Vulnerable:

Oracle January 2008 Critical Patch Update Multiple Vulnerabilities

Oracle has released its critical patch update for January 2008. The advisory addresses 26 vulnerabilities affecting Oracle Database, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business Suite, Oracle Enterprise Manager, and Oracle People Soft Enterprise.

The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly compromise affected computers.

Oracle January 2008 Critical Patch Update Multiple Vulnerabilities

Some of these issues may not require specific exploit code and may be trivial to exploit.

The following exploits are available:

• /data/vulnerabilities/exploits/27229-XDB_PITRIG_PKG.PITRIG_DROP.sql
• /data/vulnerabilities/exploits/27229-XDB_PITRIG_PKG.PITRIG_DROP-2.sql
• /data/vulnerabilities/exploits/27229-XDB_PITRIG_PKG.PITRIG_TRUNCATE.sql
• /data/vulnerabilities/exploits/27229-XDB_PITRIG_PKG.PITRIG_TRUNCATE-2.sql

Oracle January 2008 Critical Patch Update Multiple Vulnerabilities

Solution:
Oracle has released CPUJan2008 (Critical Patch Update January 2008) to address these issues. Contact the vendor for details on obtaining and applying the appropriate updates.

Oracle January 2008 Critical Patch Update Multiple Vulnerabilities

References:

• Oracle Critical Patch Update �?? January 2008 Oracle E-Business Suite 11i Impact (Integrigy)
  
• Oracle Homepage (Oracle)
  
• PeteFinnigan.com Limited advisory for Oracle January 2008 CPU (Pete Finnigan )
  
• Oracle Critical Patch Update Advisory - January 2008 (Oracle)
  
• PeteFinnigan.com Limited Oracle Security Advisory - Jan 2008 Critical Patch Upda (PeteFinnigan.com)