Oracle Hyperion: Execute Arbitrary Code/Commands -- Existing Account

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2017.0105
                    Security Advisory: Oracle Hyperion
                               19 July 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Oracle Hyperion
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Existing Account
Resolution:           Patch/Upgrade
CVE Names:            CVE-2016-0635  
Member content until: Friday, August 18 2017
Reference:            ASB-2016.0074

OVERVIEW

        Multiple vulnerabilities have been identified in Oracle Hyperion. [1]


IMPACT

        The vendor has provided the following information regarding to the 
        vulnerabilities.
        
        "This Critical Patch Update contains 1 new security fix for Oracle 
        Hyperion. This vulnerability is not remotely exploitable without 
        authentication, i.e., may not be exploited over a network without 
        requiring user credentials." [1]
        
        "CVE-2016-0635
        
        8.8
        
        AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
        
        The supported version that is affected is 12.1.3.0.0. Easily 
        exploitable vulnerability allows low privileged attacker with 
        network access via HTTP to compromise Oracle Enterprise Repository.
        Successful attacks of this vulnerability can result in takeover of 
        Oracle Enterprise Repository." [2]


MITIGATION

        Oracle states:
        
        "Due to the threat posed by a successful attack, Oracle strongly 
        recommends that customers apply CPU fixes as soon as possible. Until
        you apply the CPU fixes, it may be possible to reduce the risk of 
        successful attack by blocking network protocols required by an 
        attack. For attacks that require certain privileges or access to 
        certain packages, removing the privileges or the ability to access 
        the packages from users that do not need the privileges may help 
        reduce the risk of successful attack. Both approaches may break 
        application functionality, so Oracle strongly recommends that 
        customers test changes on non-production systems. Neither approach 
        should be considered a long-term solution as neither corrects the 
        underlying problem." [1]


REFERENCES

        [1] Oracle Critical Patch Update Advisory - July 2017
            http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

        [2] Text Form of Oracle Critical Patch Update - July 2017 Risk Matrices
            http://www.oracle.com/technetwork/security-advisory/cpujul2017verbose-3236625.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWW7uKIx+lLeg9Ub1AQg9dRAAn9z+cOChxHpXrxzj59+Uh7GRry2dRbV7
Q7mrJ7TJQCSRzXf+5F85MKIM0xLA9kcxmZU3LAMLDLhq/86Jj8deoCECrpOuRy+Z
Emy5vx8uXRAIcML0qhCnzrYRkSHBnv1LxgisRxKBQhC0lYTR+nbJblhFyRPkHYUN
QKspXIs1ZNWIX9uL671YDZI6NfVndMCD86aS2M1E8r8ORwOCXMTz5YfSKKSlHIBk
0Y0ARAs0WVQVwTZuui44o/OuPuHSfxthfHlc9jSjMH3xFKFaEpjyAVNDZcuD23ow
ovDa2zRIK1jqdE/MDxYtlPg1VCkWlebCgbo3P1pl7fEWv80OpWFvOj7pZczpszeB
+dTak3QPkyNXi+pfIahck4+bf69lj/oWMoE4DjRVMEs6XQI5qSnoihFgttZfr+aL
Bga2zvoIX37x/JylNTSS12XFHbydqxfrLBHNwdu71/Wjqk/BiIFwIBs2o7a7jilB
epTwCzIo5jYO3Hzz4ISwST/ROBZ0ZfCi/o2Wcet66AYIz9fde/4mgZ0tOTeZzQ41
b5IYtzqB4aMCZ1NLCrzSKsyyou4ZBexW1ps8HeJy1OU+OOwtkITl1TM6YVKp4gbX
FsirrkBKU2lWowTNvtbLM9v+bKEb+AyBySEk18jQiWk8KXZuaU+WIHP6L3gGloMS
6+UvIrRIgWE=
=Y4Sv
-----END PGP SIGNATURE-----