Qualys Vulnerability R&D Lab has released new vulnerability checks in the Qualys Cloud Platform to protect organizations against 60 vulnerabilities that were fixed in 8 bulletins announced today by Oracle. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Oracle has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
JRE and JDK are exposed to multiple vulnerabilities that affect various components. Oracle's Java Critical Patch Update for October 2014 contains 25 new security fixes across multiple Java SE products and sub-products.
Affected Versions:
Oracle Java JDK and JRE, versions 5.0u71 and earlier, 6u81 and earlier, 7u67 and earlier, 8u20 and earlier.
Updates for Java 5 and Java 6 are no longer available to the public. Oracle offers updates to Java 5 and Java 6 only for customers who have purchased Java support or have Oracle products that require Java 5 and Java 6.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Oracle Java SE CPU October 2014 Oracle Java
Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0 and 12.1.3.0 are exposed to multiple unspecified vulnerabilities that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
QID Detection Logic (Authenticated) :
Operating System: Linux
This QID checks to see if Oracle WebLogic Server process is listening on any of the TCP ports. If so, for version 12.1.2 and later it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the patch files found in the directory "Oracle_Home"\inventry\patches to check if the installed version is patched.
For version 12.1.1.0, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\wlserver_12.1\bugsfixed\WLS-PSU-bugsfixed.txt to check if the installed version is patched.
For version 10.3.6.x, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\wlserver_10.3\bugsfixed\WLS-PSU-bugsfixed.txt to check if the installed version is patched.
QID Detection Logic (Authenticated) :
Operating System: Windows
For affected 12.1.2 and later version
The QID checks the "Oracle_Home" path with help of the registry key "HKLM\Software\Oracle". The QID verifies if the affected WebLogic version is installed on the host and then checks if the corresponding patch is applied or not.
For 10.3.6.0
The QID checks if WebLogic v10.3.6.0 is installed by looking at the file <INSTALL DRIVE>\Oracle\Middleware\wlserver_10.3\.product.properties. The QID then checks if the corresponding patch is applied or not.
For 12.1.1.0
The QID checks if WebLogic v12.1.1.0 is installed by looking at the file <INSTALL DRIVE>\Oracle\Middleware\wlserver_12.1\.product.properties. The QID then checks if the corresponding patch is applied or not.
QID Detection Logic (Unauthenticated) :
The qid sends a "GET console/login/LoginForm.jsp" request to retrieve the WebLogic version installed.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CPUOCT2014
The following Oracle database component are affected:
- JPublisher
- Java VM
- SQLJ
- Application Express
- JDBC
- Core RDBMS
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CPUOCT2014 Oracle Database(database)
Affected Software:
Oracle Database 11.2.0.4
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Oracle 11.2.0.4.4
Affected Software:
Oracle Database 11.2.0.3
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Oracle 11.2.0.3.12
Affected Software:
Oracle Database 11.1.0.7
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Oracle 11.1.0.7.21
Affected Software:
Oracle Database 12.1.0.2
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Oracle 12.1.0.2.1
Affected Software:
Oracle Database 12.1.0.1
Patches:
The following are links for downloading patches to fix these vulnerabilities:
Oracle 12.1.0.1.5
These new vulnerability checks are included in Qualys vulnerability signature 2.2.843-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
To perform a selective vulnerability scan, configure a scan profile to use the following options:
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Platforms and Platform Identification
For more information, customers may contact Qualys Technical Support.
The Qualys Cloud Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.