Just FYI –
“Currently there are eight Proof of Concept (PoC) codes implementing three different privilege elevation techniques for gaining the administrator role in a target database environment”.
That being said, the proofs of concept are not publically available but there is also no patch at this time. The next scheduled updates from Oracle are on July 15.
Krzysztof Bakowski
Facilities, Real Estate & Auxiliary Services IT
University of Delaware
From: MS-ISAC Advisory [mailto:MS-ISAC.Advisory@msisac.org]
Sent: Tuesday, June 17, 2014 2:20 PM
To: William Pelgrin
Subject: CIS CYBER SECURITY ADVISORY – Multiple Vulnerabilities in Oracle Database Could Allow Remote Code Execution – TLP: WHITE
Importance: High
TLP: WHITE
CIS CYBER SECURITY ADVISORY
CIS ADVISORY NUMBER:
2014-056
DATE(S) ISSUED:
06/17/2014
SUBJECT:
Multiple Vulnerabilities in Oracle Database Could Allow Remote Code Execution
EXECUTIVE SUMMARY:
Multiple unspecified vulnerabilities have been discovered in Oracle Database that could allow remote code execution. Oracle Database is a database management system. Successful exploitation of these vulnerabilities could result in either an attacker gaining the same privileges as the logged on user, or gaining session authentication credentials. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.
THREAT INTELLIGENCE:
Currently there are eight Proof of Concept (PoC) codes implementing three different privilege elevation techniques for gaining the administrator role in a target database environment. However, none of these PoCs are available publicly. Please note that patch is not available at this time.
SYSTEMS AFFECTED:
· Oracle Database 11g Release 2 (11.2.0.1.0) for Microsoft Windows x64
· Oracle Database 11g Release 2 (11.2.0.4.5) Patch Bundle 18590877 for Microsoft Windows x64
· Oracle Database 12c Release 1 (12.1.0.1.0) for Microsoft Windows x64
· Oracle Database 12c Release 1 (12.1.0.1.9) Bundle Patch 18724015 for Microsoft Windows x64
RISK:
Government:
· Large and medium government entities: High
· Small government entities: High
Businesses:
· Large and medium business entities: High
· Small business entities: High
Home users: N/A
TECHNICAL SUMMARY:
Twenty vulnerabilities have been reported for Oracle Database. Details of the vulnerabilities are not available at this time, however, it has been reported that a malicious user with the bare minimum privileges required to connect and login to Oracle Database can successfully execute arbitrary Java code on the Oracle Database.
Successful exploitation could result in an attacker gaining the same privileges as the affected application. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Failed exploit attempts will likely cause denial-of-service conditions.
RECOMMENDATIONS:
We recommend the following actions be taken:
· Update vulnerable Oracle Database products immediately after appropriate testing when a patch becomes available.
· Consider limiting access to Oracle Server until patch becomes available
· Consider implementing the CIS Benchmarks for Oracle Database Server
REFERENCES:
Full Disclosure:
http://seclists.org/fulldisclosure/2014/Jun/79
SecurityFocus:
http://www.securityfocus.com/bid/68057
Center for Internet Security (CIS)
31 Tech Valley Drive
East Greenbush, NY 12061
7×24 SOC: 1-866-787-4722 (518-266-3488)
Email: soc
Follow us @CISecurity
TLP:WHITE
Traffic Light Protocol (TLP): WHITE information may be distributed without restriction, subject to copyright controls.
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.
. . .