Oracle security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 60 vulnerabilities that were fixed in 8 bulletins announced today by Oracle. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Oracle has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Oracle Java SE Critical Patch Update - October 2014

  Severity

  Urgent 5

  Qualys ID

  122741

  Vendor Reference

  Oracle Java SE CPU October 2014

  CVE Reference

  CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6466, CVE-2014-6468, CVE-2014-6476, CVE-2014-6485, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6504, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6513, CVE-2014-6515, CVE-2014-6517, CVE-2014-6519, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558, CVE-2014-6562

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Java Runtime Environment (JRE) is a platform that supports the execution of programs that are developed using the Java programming language. The JRE platform also supports Java Applets, which can be loaded from Web pages.

  JRE and JDK are exposed to multiple vulnerabilities that affect various components. Oracle's Java Critical Patch Update for October 2014 contains 25 new security fixes across multiple Java SE products and sub-products.

  Affected Versions:
  Oracle Java JDK and JRE, versions 5.0u71 and earlier, 6u81 and earlier, 7u67 and earlier, 8u20 and earlier.

  Consequence

  Exploitation could allow an attacker to take complete control of an affected system.

  Solution

  The vendor released updates (Java SE JDK and JRE 8 Update 25, Java SE JDK and JRE 7 Update 71, Java SE JDK and JRE 6 Update 85, Java SE JDK and JRE 5.0 Update 75) to resolve these issues. Refer to vendor advisory Oracle Java SE CPU October 2014 and Oracle Doc ID 1931846.1 to obtain more details.

  Updates for Java 5 and Java 6 are no longer available to the public. Oracle offers updates to Java 5 and Java 6 only for customers who have purchased Java support or have Oracle products that require Java 5 and Java 6.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Oracle Java SE CPU October 2014 Oracle Java

• Oracle WebLogic Server Multiple Unspecified Vulnerabilities (CPUOCT2014)

  Severity

  Serious 3

  Qualys ID

  87268

  Vendor Reference

  Oracle WebLogic Server CPUOCT2014

  CVE Reference

  CVE-2014-0114, CVE-2014-6499, CVE-2014-6534

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  Oracle WebLogic Server (formerly known as BEA WebLogic Server) is an application server for building and deploying enterprise applications and services.

  Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0 and 12.1.3.0 are exposed to multiple unspecified vulnerabilities that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security. QID Detection Logic (Authenticated) :
  Operating System: Linux
  This QID checks to see if Oracle WebLogic Server process is listening on any of the TCP ports. If so, for version 12.1.2 and later it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the patch files found in the directory "Oracle_Home"\inventry\patches to check if the installed version is patched.
  For version 12.1.1.0, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\wlserver_12.1\bugsfixed\WLS-PSU-bugsfixed.txt to check if the installed version is patched.
  For version 10.3.6.x, it gets the "Oracle_Home" path, navigates to that directory and reads "registry.xml" and the file "Oracle_Home"\wlserver_10.3\bugsfixed\WLS-PSU-bugsfixed.txt to check if the installed version is patched.

  QID Detection Logic (Authenticated) :
  Operating System: Windows
  For affected 12.1.2 and later version
  The QID checks the "Oracle_Home" path with help of the registry key "HKLM\Software\Oracle". The QID verifies if the affected WebLogic version is installed on the host and then checks if the corresponding patch is applied or not.

  For 10.3.6.0
  The QID checks if WebLogic v10.3.6.0 is installed by looking at the file <INSTALL DRIVE>\Oracle\Middleware\wlserver_10.3\.product.properties. The QID then checks if the corresponding patch is applied or not.

  For 12.1.1.0
  The QID checks if WebLogic v12.1.1.0 is installed by looking at the file <INSTALL DRIVE>\Oracle\Middleware\wlserver_12.1\.product.properties. The QID then checks if the corresponding patch is applied or not.

  QID Detection Logic (Unauthenticated) :
  The qid sends a "GET console/login/LoginForm.jsp" request to retrieve the WebLogic version installed.

  Consequence

  Successfully exploiting this vulnerability might allow remote attacker to affect confidentiality, integrity, and availability of Oracle WebLogic Server.

  Solution

  The vendor has released patches for these issues. Refer to Oracle CPUOCT2014 for detailed information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CPUOCT2014

• Oracle Database October 2014 Security Update Multiple Vulnerabilities (CPUOCT2014)

  Severity

  Critical 4

  Qualys ID

  19948

  Vendor Reference

  CPUOCT2014

  CVE Reference

  CVE-2014-0050, CVE-2014-2478, CVE-2014-4289, CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4293, CVE-2014-4294, CVE-2014-4295, CVE-2014-4296, CVE-2014-4297, CVE-2014-4298, CVE-2014-4299, CVE-2014-4300, CVE-2014-4301, CVE-2014-4310, CVE-2014-6452, CVE-2014-6453, CVE-2014-6454, CVE-2014-6455, CVE-2014-6467, CVE-2014-6483, CVE-2014-6537, CVE-2014-6538, CVE-2014-6542, CVE-2014-6544, CVE-2014-6545, CVE-2014-6546, CVE-2014-6547, CVE-2014-6560, CVE-2014-6563

  CVSS Scores

  Base 9 / Temporal 7

  Description

  Oracle released a Critical Patch Update advisory for October 2014 that addresses several security vulnerabilities.

  The following Oracle database component are affected:
  - JPublisher
  - Java VM
  - SQLJ
  - Application Express
  - JDBC
  - Core RDBMS
  

  Consequence

  An attacker could affect the confidentiality, integrity and availability of data on the target system.

  Solution

  Oracle recommends that customers upgrade to the latest supported version of Oracle products in order to obtain the patches.
  Read Oracle Critical Patch Update Advisory - OCT 2014 for further information about the products affected and issues addressed.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CPUOCT2014 Oracle Database(database)

• Oracle Database October 2014 Patch Set Update (PSU) 11.2.0.4.4 Not Installed (Patch 19121551)

  Severity

  Critical 4

  Qualys ID

  19947

  Vendor Reference

  Oracle Metalink, Doc ID 1912224.1

  CVE Reference

  CVE-2014-6488, CVE-2014-6537

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

  Affected Software:
  Oracle Database 11.2.0.4

  Consequence

  Failure to apply this patch could lead to loss of the integrity of the database.

  Solution

  Refer to 11.2.0.4.4 Patch Set Update to obtain details about how to deploy the update.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Oracle 11.2.0.4.4

• Oracle Database October 2014 Patch Set Update (PSU) 11.2.0.3.12 Not Installed (Patch 19121548)

  Severity

  Critical 4

  Qualys ID

  19946

  Vendor Reference

  Oracle Metalink, Doc ID 1912224.1

  CVE Reference

  CVE-2014-6488, CVE-2014-6537

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

  Affected Software:
  Oracle Database 11.2.0.3

  Consequence

  Failure to apply this patch could lead to loss of the integrity of the database.

  Solution

  Refer to 11.2.0.3.12 Patch Set Update to obtain details about how to deploy the update.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Oracle 11.2.0.3.12

• Oracle Database October 2014 Patch Set Update (PSU) 11.1.0.7.21 Not Installed (Patch 19152553)

  Severity

  Critical 4

  Qualys ID

  19945

  Vendor Reference

  Oracle Metalink, Doc ID 1912224.1

  CVE Reference

  CVE-2014-6488, CVE-2014-6537

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

  Affected Software:
  Oracle Database 11.1.0.7

  Consequence

  Failure to apply this patch could lead to loss of the integrity of the database.

  Solution

  Refer to 11.1.0.7.21 Patch Set Update to obtain details about how to deploy the update.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Oracle 11.1.0.7.21

• Oracle Database October 2014 Patch Set Update (PSU) 12.1.0.2.1 Not Installed (Patch 19392646)

  Severity

  Critical 4

  Qualys ID

  19944

  Vendor Reference

  Oracle Metalink, Doc ID 1912224.1

  CVE Reference

  CVE-2014-6537

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

  Affected Software:
  Oracle Database 12.1.0.2

  Consequence

  Failure to apply this patch could lead to loss of the integrity of the database.

  Solution

  Refer to 12.1.0.2.1 Patch Set Update to obtain details about how to deploy the update.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Oracle 12.1.0.2.1

• Oracle Database October 2014 Patch Set Update (PSU) 12.1.0.1.5 Not Installed (Patch 19121550)

  Severity

  Critical 4

  Qualys ID

  19943

  Vendor Reference

  Oracle Metalink, Doc ID 1912224.1

  CVE Reference

  CVE-2014-6537

  CVSS Scores

  Base 6.5 / Temporal 5.1

  Description

  Oracle Database Patch Set Updates are proactive cumulative patches containing recommended bug fixes that are released on a regular schedule.

  Affected Software:
  Oracle Database 12.1.0.1

  Consequence

  Failure to apply this patch could lead to loss of the integrity of the database.

  Solution

  Refer to 12.1.0.1.5 Patch Set Update to obtain details about how to deploy the update.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Oracle 12.1.0.1.5

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.