-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2018.0014
  Multiple vulnerabilities have been identified in Oracle Database Server
                              17 January 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Oracle Database Server
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                      Modify Arbitrary Files          -- Remote with User Interaction
                      Read-only Data Access           -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2018-2699 CVE-2018-2680 CVE-2018-2575
                      CVE-2017-12617 CVE-2017-10282 
Member content until: Friday, February 16 2018
Reference:            ESB-2017.2487

OVERVIEW

        Multiple vulnerabilities have been identified in Application Express
        versions prior to 5.1.4.00.08 and Oracle Database Server, versions 
        11.2.0.4, 12.1.0.2, 12.2.0.1. [1]


IMPACT

        The vendor has provided the following information regarding
        the vulnerabilities:
        
        "This Critical Patch Update contains 5 new security fixes
        for the Oracle Database Server. 3 of these vulnerabilities
        may be remotely exploitable without authentication,  i.e.,
        may be exploited over a network without requiring user
        credentials. 1 of these fixes is applicable to client-only
        installations,  i.e., installations that do not have the
        Oracle Database Server  installed." [1]
        
        "CVE-2017-10282
        
        9.1
        
        AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
        
        Easily exploitable vulnerability allows high privileged
        attacker having Create Session, Execute Catalog Role
        privilege with network access via Oracle Net to compromise
        Core RDBMS.  While the vulnerability is in Core RDBMS,
        attacks may significantly impact additional products.
        Successful attacks of this vulnerability can result in
        takeover of Core RDBMS.
        
        CVE-2018-2680
        
        8.3
        
        AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
        
        Difficult to exploit vulnerability allows unauthenticated
        attacker with network access via multiple protocols to
        compromise Java VM.  Successful attacks require human
        interaction from a person other than the attacker and while
        the vulnerability is in Java VM, attacks may significantly
        impact additional products. Successful attacks of this
        vulnerability can result in takeover of Java VM.
        
        CVE-2017-12617
        
        8.1
        
        AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
        
        Difficult to exploit vulnerability allows unauthenticated
        attacker with network access via HTTP to compromise WLM
        (Apache Tomcat).  Successful attacks of this vulnerability
        can result in takeover of WLM (Apache Tomcat).
        
        CVE-2018-2699
        
        6.1
        
        AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
        
        Easily exploitable vulnerability allows unauthenticated
        attacker with network access via HTTP to compromise
        Application Express.  Successful attacks require human
        interaction from a person other than the attacker and while
        the vulnerability is in Application Express, attacks may
        significantly impact additional products. Successful attacks
        of this vulnerability can result in  unauthorized update,
        insert or delete access to some of Application Express
        accessible data as well as  unauthorized read access to a
        subset of Application Express accessible data.
        
        CVE-2018-2575
        
        2.0
        
        AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
        
        Difficult to exploit vulnerability allows high privileged
        attacker having Local Logon privilege with network access
        via multiple protocols to compromise Core RDBMS.  Successful
        attacks require human interaction from a person other than
        the attacker. Successful attacks of this vulnerability can
        result in  unauthorized read access to a subset of Core
        RDBMS accessible data. Note: Applicable only to Windows
        platform." [2]


MITIGATION

        Oracle states:
        
        "Due to the threat posed by a successful attack, Oracle
        strongly recommends that customers apply CPU fixes as soon
        as possible. Until you apply the CPU fixes, it may be
        possible to reduce the risk of successful attack by blocking
        network protocols required by an attack. For attacks that
        require certain privileges or access to certain packages,
        removing the privileges or the ability to access the
        packages from users that do not need the privileges may help
        reduce the risk of successful attack. Both approaches may
        break application functionality, so Oracle strongly
        recommends that customers test changes on non-production
        systems. Neither approach should be considered a long-term
        solution as neither corrects the underlying problem." [1]


REFERENCES

        [1] Oracle Critical Patch Update Advisory - January 2018
            http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

        [2] Text Form of Oracle Critical Patch Update - January 2018 Risk
            Matrices
            http://www.oracle.com/technetwork/security-advisory/cpujan2018verbose-3236630.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWl7Vg4x+lLeg9Ub1AQiSVA//UDkYIciS42c0lvXsu6ZE6egvQDcHwCaA
nYNBS8znqCupyVpH57wkX18z70IWvvKcVgphpgXmqTjFJByp9UrLU69y4uPkC2k4
9oZcSE2OJIAGH5zxerg0WAK/0PickhRes0ZQA1v2Fs21iVKQe/kaTS5o+hdaGMwp
yfd0hxIfR2ml8dFtDkpW4qmHTLt0lsqoalb24VTwa2pTKuorcynoHwA4U6tZQ96w
n/RuIDkswjOrrT9N0VTOoDGrMEDbtkAAOsKgA/QZhk9FRZAlV3If36LE+JffHG7F
WCtvzHBto0K3KSbP1KjtHMk87pdP2AeGMI1bH1AjP9mah+8eujeWqBSE9BIz8J68
8qETqYKhpMIgAi+RIyCMIrkSwWEegF7T7VljODtQ4IP+3tqc2To6KEE3/S4kDVs5
KKj2C7hdF1pjKuqSDhsLfQnL6kInoixyW5Bn3IlfqwvvDrDRQbiscZplHWdypbr0
TjYbOFDKOvVFhytsbSLP26eBCMkRZ4rXeEY0I9BLtzhKvzzR69vevNNtkcnjhrEr
sZEgGmjMdjRzqJHPDofub2Gy2ZZuq9+k0SqeN3u7NubKX9mFlTpqsYgi4r1XPtQB
JWrjtz1rnYT79cQSwxbZtt1cn1X4b2xqaOSSek/UOheNT7/e4BmWIp2S9HO4o8ne
O8Jx0cUSEa0=
=aw1e
-----END PGP SIGNATURE-----