Oracle January 2020 Critical Patch Update Contains 255 CVEs
Oracle rings in the new year with its first Critical Patch Update of 2020 addressing 255 CVEs across 334 security patches, including critical vulnerabilities in Oracle WebLogic Server.
背景
On January 14, Oracle released its Critical Patch Update (CPU) for January 2020 as part of its quarterly release of security patches. This update contains fixes for 255 CVEs in 334 patches across multiple Oracle products. The following is the full list of product families with vulnerabilities addressed in this month’s release:
- Oracle Database Server
- Oracle Communications Applications
- Oracle Construction and Engineering
- Oracle E-Business Suite
- Oracle Enterprise Manager
- Oracle Financial Services Applications
- Oracle Food and Beverage Applications
- Oracle Fusion Middleware
- Oracle GraalVM
- Oracle Health Sciences Applications
- Oracle Hospitality Applications
- Oracle Hyperion
- Oracle iLearning
- Oracle Java SE
- Oracle JD Edwards
- Oracle MySQL
- Oracle PeopleSoft
- Oracle Retail Applications
- Oracle Siebel CRM
- Oracle Systems
- Oracle Supply Chain
- Oracle Utilities Applications
- Oracle Virtualization
分析
This quarter’s CPU included 43 critical vulnerabilities across 25 unique CVEs, 41 of which can be remotely exploited without authentication. The most widely patched product families include Oracle Enterprise Manager (50 patches), Oracle Fusion Middleware (38 patches), Oracle Communications Applications (25 patches), Oracle E-Business Suite (23 patches) and Oracle MySQL (19 patches). Here we describe in more detail some of the critically scored CVEs.
Oracle E-Business Suite | CVE-2020-2586, CVE-2020-2587
CVE-2020-2586 and CVE-2020-2587 were the highest-scoring CVEs in Oracle’s January 2020 CPU, with an Oracle assigned CVSSv3 base score of 9.9. These unspecified vulnerabilities in the Hierarchy Diagrammers component of Oracle Human Resources have been described by Oracle as “easily exploitable.” The vulnerabilities allow attackers with network access via HTTPS and low-level privileges to compromise Oracle Human Resources with successful attacks resulting in the unauthorized access, creation, deletion and modification of Oracle Human Resources accessible data. Access to this data may also allow an attacker to cause a partial denial-of-service (DoS). Versions of Oracle Human Resources affected are 12.1.1–12.1.3 and 12.2.3–12.2.9.
Oracle Fusion Middleware | CVE-2020-2555, CVE-2020-2551, CVE-2020-2546
CVE-2020-2555 is an unspecified vulnerability described as “easily exploitable” in the Caching, CacheStore, Invocation component of Oracle Coherence that allows an unauthenticated attacker network access via Oracle’s T3 protocol complete takeover of Oracle Coherence.
CVE-2020-2551 and CVE-2020-2546 are unspecified vulnerabilities described as “easily exploitable” in the WLS Core Components (CVE-2020-2551) and Application Container - JavaEE (CVE-2020-2546) components of Oracle WebLogic Server. An unauthenticated attacker with network access via Internet Inter-Orb Protocol (IIOP) can compromise and take over the Oracle WebLogic Server.
Oracle MySQL | CVE-2019-8457
CVE-2019-8457 is a heap out-of-bounds read vulnerability in the SQLite component of Oracle MySQL that could allow an unauthenticated attacker to compromise and take over MySQL Cluster. Versions of Oracle MySQL affected are 7.3.27 and prior, 7.4.25 and prior, 7.5.15 and prior as well as 7.6.12 and prior.
Oracle Retail Applications | CVE-2019-2904, CVE-2016-5019, CVE-2019-12419
CVE-2019-2904 is an unspecified vulnerability affecting a series of Application Development Framework (ADF) components, including the Application Core component in Oracle Retail Assortment Planning, the Dataset component in Oracle Retail Clearance Optimization Engine, the Common Component Integration component in Oracle Retail Markdown Optimization and the Operational Insights component in Oracle Retail Sales Audit. An unauthenticated attacker with network access via HTTP could exploit this vulnerability with crafted HTTP requests resulting in the compromise and takeover of the ADF.
CVE-2016-5019 is a deserialization attack vulnerability in the Dataset and General Application components of Oracle Retail Clearance Optimization Engine. An attacker could submit an untrusted, specially crafted serialized view state string with the potential to inflict DoS or execute arbitrary code on the target upon it being deserialized.
CVE-2019-12419 is a vulnerability in the token access services in the Order Broker Foundation component of Oracle Retail Order Broker that allows for authentication bypass, as it does not validate the authenticated principal of the clientId parameter in the request. If an attacker obtains a victim’s authorization code, they could obtain a valid access token for said victim. According to the CPU advisory, only version 15 of Oracle Retail Order Broker is affected.
Oracle System | CVE-2019-9636, CVE-2019-2729, CVE-2019-2725, CVE-2016-1000031
CVE-2019-9636 is a vulnerability caused by the improper handling of Unicode encoding (with an incorrect netloc) during Normalization Form Canonical Composition (NFKC) normalization in the Operating System Image component of Sun ZFS Storage Application Kit. An attacker could pass a specially crafted URL that could be incorrectly parsed, potentially disclosing information such as cookies, credentials and authentication data, which could then be passed to a different host when parsed correctly. Only version 8.8.6 of the Sun ZFS Storage Application Kit is affected, according to the January 2020 CPU Advisory.
CVE-2019-2729 and CVE-2019-2725 are unspecified vulnerabilities in the WebLogic Server component of Tape Library Automated Cartridge System Library Software (ACSLS) highlighted as “easily exploitable.” An unauthenticated attacker could exploit this vulnerability requiring only network access via HTTP to compromise and take over the server. Only version 8.5 of the Sun ZFS Storage Application Kit is affected, according to the January 2020 CPU Advisory.
CVE-2016-1000031 is a remote code execution vulnerability found in Apache Commons FileUpload library in the Software component of Tape Library ACSLS. This vulnerability, which has historically been patched for other Oracle products, is easily exploitable, allowing an attacker to compromise the Tape Library ACSLS using HTTP requests.
解决方案
Customers are advised to apply all relevant patches provided by Oracle in this CPU. Please refer to the January 2020 advisory for full details.
识别受影响的系统
用于识别这些漏洞的 Tenable 插件列表在发布时将显示在此处。
获取更多信息
- Oracle Critical Patch Update Advisory - January 2020
- Oracle Advisory to CVE Map
- January 2020 CPU Risk Matrix Page
加入 Tenable Community 中的 Tenable 安全响应团队
了解有关 Tenable 这款首创 Cyber Exposure 平台的更多信息，全面管理现代攻击面。
获取 30 天免费试用版 Tenable.io Vulnerability Management。
相关文章
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
- Vulnerability Management