Oracle security alert.

October 14, 2014

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 60 vulnerabilities that were fixed in 8 bulletins announced today by Oracle. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Oracle has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Oracle Java SE Critical Patch Update - October 2014

    Severity
    Urgent 5
    Qualys ID
    122741
    Vendor Reference
    Oracle Java SE CPU October 2014
    CVE Reference
    CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6466, CVE-2014-6468, CVE-2014-6476, CVE-2014-6485, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6504, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6513, CVE-2014-6515, CVE-2014-6517, CVE-2014-6519, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558, CVE-2014-6562
    CVSS Scores
    Base 10 / Temporal 8.3
    Description
    Java Runtime Environment (JRE) is a platform that supports the execution of programs that are developed using the Java programming language. The JRE platform also supports Java Applets, which can be loaded from Web pages.

    JRE and JDK are exposed to multiple vulnerabilities that affect various components. Oracle's Java Critical Patch Update for October 2014 contains 25 new security fixes across multiple Java SE products and sub-products.

    Affected Versions:
    Oracle Java JDK and JRE, versions 5.0u71 and earlier, 6u81 and earlier, 7u67 and earlier, 8u20 and earlier.

    Consequence
    Exploitation could allow an attacker to take complete control of an affected system.
    Solution
    The vendor released updates (Java SE JDK and JRE 8 Update 25, Java SE JDK and JRE 7 Update 71, Java SE JDK and JRE 6 Update 85, Java SE JDK and JRE 5.0 Update 75) to resolve these issues. Refer to vendor advisory Oracle Java SE CPU October 2014 and Oracle Doc ID 1931846.1 to obtain more details.

    Updates for Java 5 and Java 6 are no longer available to the public. Oracle offers updates to Java 5 and Java 6 only for customers who have purchased Java support or have Oracle products that require Java 5 and Java 6.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Oracle Java SE CPU October 2014 Oracle Java

  • Oracle WebLogic Server Multiple Unspecified Vulnerabilities (CPUOCT2014)

    Severity
    Serious 3
    Qualys ID
    87268
    Vendor Reference
    Oracle WebLogic Server CPUOCT2014
    CVE Reference
    CVE-2014-0114, CVE-2014-6499, CVE-2014-6534
    CVSS Scores
    Base 7.5 / Temporal 6.2
    Description
    Oracle WebLogic Server (formerly known as BEA WebLogic Server) is an application server for building and deploying enterprise applications and services.

    Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0 and 12.1.3.0 are exposed to multiple unspecified vulnerabilities that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security. QID Detection Logic (Authenticated) :
    Operating System: Linux
    This QID checks to see if Oracle WebLogic Server process is listening on any of the TCP ports. If so, for version 12.1.2 and later it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the patch files found in the directory "Oracle_Home"\inventry\patches to check if the installed version is patched.
    For version 12.1.1.0, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\wlserver_12.1\bugsfixed\WLS-PSU-bugsfixed.txt to check if the installed version is patched.
    For version 10.3.6.x, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\wlserver_10.3\bugsfixed\WLS-PSU-bugsfixed.txt to check if the installed version is patched.

    QID Detection Logic (Authenticated) :
    Operating System: Windows
    For affected 12.1.2 and later version
    The QID checks the "Oracle_Home" path with help of the registry key "HKLM\Software\Oracle". The QID verifies if the affected WebLogic version is installed on the host and then checks if the corresponding patch is applied or not.

    For 10.3.6.0
    The QID checks if WebLogic v10.3.6.0 is installed by looking at the file <INSTALL DRIVE>\Oracle\Middleware\wlserver_10.3\.product.properties. The QID then checks if the corresponding patch is applied or not.

    For 12.1.1.0
    The QID checks if WebLogic v12.1.1.0 is installed by looking at the file <INSTALL DRIVE>\Oracle\Middleware\wlserver_12.1\.product.properties. The QID then checks if the corresponding patch is applied or not.

    QID Detection Logic (Unauthenticated) :
    The qid sends a "GET console/login/LoginForm.jsp" request to retrieve the WebLogic version installed.

    Consequence
    Successfully exploiting this vulnerability might allow remote attacker to affect confidentiality, integrity, and availability of Oracle WebLogic Server.
    Solution
    The vendor has released patches for these issues. Refer to Oracle CPUOCT2014 for detailed information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CPUOCT2014

  • Oracle Database October 2014 Security Update Multiple Vulnerabilities (CPUOCT2014)

    Severity
    Critical 4
    Qualys ID
    19948
    Vendor Reference
    CPUOCT2014
    CVE Reference
    CVE-2014-0050, CVE-2014-2478, CVE-2014-4289, CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4293, CVE-2014-4294, CVE-2014-4295, CVE-2014-4296, CVE-2014-4297, CVE-2014-4298, CVE-2014-4299, CVE-2014-4300, CVE-2014-4301, CVE-2014-4310, CVE-2014-6452, CVE-2014-6453, CVE-2014-6454, CVE-2014-6455, CVE-2014-6467, CVE-2014-6483, CVE-2014-6537, CVE-2014-6538, CVE-2014-6542, CVE-2014-6544, CVE-2014-6545, CVE-2014-6546, CVE-2014-6547, CVE-2014-6560, CVE-2014-6563
    CVSS Scores
    Base 9 / Temporal 7
    Description
    Oracle released a Critical Patch Update advisory for October 2014 that addresses several security vulnerabilities.

    The following Oracle database component are affected:
    - JPublisher
    - Java VM
    - SQLJ
    - Application Express
    - JDBC
    - Core RDBMS

    Consequence
    An attacker could affect the confidentiality, integrity and availability of data on the target system.
    Solution
    Oracle recommends that customers upgrade to the latest supported version of Oracle products in order to obtain the patches.
    Read Oracle Critical Patch Update Advisory - OCT 2014 for further information about the products affected and issues addressed.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CPUOCT2014 Oracle Database(database)

  • Oracle Database October 2014 Patch Set Update (PSU) 11.2.0.4.4 Not Installed (Patch 19121551)

    Severity
    Critical 4
    Qualys ID
    19947
    Vendor Reference
    Oracle Metalink, Doc ID 1912224.1
    CVE Reference
    CVE-2014-6488, CVE-2014-6537
    CVSS Scores
    Base 6.5 / Temporal 5.1
    Description
    Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

    Affected Software:
    Oracle Database 11.2.0.4

    Consequence
    Failure to apply this patch could lead to loss of the integrity of the database.
    Solution
    Refer to 11.2.0.4.4 Patch Set Update to obtain details about how to deploy the update.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Oracle 11.2.0.4.4

  • Oracle Database October 2014 Patch Set Update (PSU) 11.2.0.3.12 Not Installed (Patch 19121548)

    Severity
    Critical 4
    Qualys ID
    19946
    Vendor Reference
    Oracle Metalink, Doc ID 1912224.1
    CVE Reference
    CVE-2014-6488, CVE-2014-6537
    CVSS Scores
    Base 6.5 / Temporal 5.1
    Description
    Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

    Affected Software:
    Oracle Database 11.2.0.3

    Consequence
    Failure to apply this patch could lead to loss of the integrity of the database.
    Solution
    Refer to 11.2.0.3.12 Patch Set Update to obtain details about how to deploy the update.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Oracle 11.2.0.3.12

  • Oracle Database October 2014 Patch Set Update (PSU) 11.1.0.7.21 Not Installed (Patch 19152553)

    Severity
    Critical 4
    Qualys ID
    19945
    Vendor Reference
    Oracle Metalink, Doc ID 1912224.1
    CVE Reference
    CVE-2014-6488, CVE-2014-6537
    CVSS Scores
    Base 6.5 / Temporal 5.1
    Description
    Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

    Affected Software:
    Oracle Database 11.1.0.7

    Consequence
    Failure to apply this patch could lead to loss of the integrity of the database.
    Solution
    Refer to 11.1.0.7.21 Patch Set Update to obtain details about how to deploy the update.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Oracle 11.1.0.7.21

  • Oracle Database October 2014 Patch Set Update (PSU) 12.1.0.2.1 Not Installed (Patch 19392646)

    Severity
    Critical 4
    Qualys ID
    19944
    Vendor Reference
    Oracle Metalink, Doc ID 1912224.1
    CVE Reference
    CVE-2014-6537
    CVSS Scores
    Base 6.5 / Temporal 5.1
    Description
    Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

    Affected Software:
    Oracle Database 12.1.0.2

    Consequence
    Failure to apply this patch could lead to loss of the integrity of the database.
    Solution
    Refer to 12.1.0.2.1 Patch Set Update to obtain details about how to deploy the update.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Oracle 12.1.0.2.1

  • Oracle Database October 2014 Patch Set Update (PSU) 12.1.0.1.5 Not Installed (Patch 19121550)

    Severity
    Critical 4
    Qualys ID
    19943
    Vendor Reference
    Oracle Metalink, Doc ID 1912224.1
    CVE Reference
    CVE-2014-6537
    CVSS Scores
    Base 6.5 / Temporal 5.1
    Description
    Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

    Affected Software:
    Oracle Database 12.1.0.1

    Consequence
    Failure to apply this patch could lead to loss of the integrity of the database.
    Solution
    Refer to 12.1.0.1.5 Patch Set Update to obtain details about how to deploy the update.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Oracle 12.1.0.1.5

These new vulnerability checks are included in Qualys vulnerability signature 2.2.843-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 122741
    • 87268
    • 19948
    • 19947
    • 19946
    • 19945
    • 19944
    • 19943
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.