-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
******************************************************************
Alert ID : GCSA-14023
Data : 17 Luglio 2014
Titolo : Oracle Critical Patch Update Advisory (July 2014)
******************************************************************
:: Descrizione del problema
Oracle ha rilasciato la Critical Patch Update July 2014.
L'aggiornamento e' una collezione di patch che risolvono difetti
di sicurezza e non, presenti in vari prodotti e componenti Oracle.
Oracle raccomanda di applicare gli aggiornamenti appena possibile.
:: Software interessato
Oracle Database 11g Release 1, version 11.1.0.7
Oracle Database 11g Release 2, versions 11.2.0.3, 11.2.0.4
Oracle Database 12c Release 1, version 12.1.0.1
Oracle Fusion Middleware 11g Release 1, version 11.1.1.7
Oracle Fusion Middleware 12c Release 1, version 12.1.2.0
Oracle Fusion Applications, versions 11.1.2 through 11.1.8
Oracle Glassfish Server, versions 2.1.1, 3.0.1, 3.1.2
Oracle Traffic Director, version 11.1.1.7.0
Oracle iPlanet Web Proxy Server, version 4.0.24
Oracle iPlanet Web Server, versions 6.1, 7.0
Oracle WebCenter Portal, versions 11.1.1.7.0, 11.1.1.8.0
Oracle WebLogic Server, versions 10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0
Oracle JDeveloper, versions 11.1.1.7.0, 11.1.2.4.0, 12.1.2.0.0
Oracle BI Publisher, version 11.1.1.7
Oracle Glassfish Communications Server, version 2.0
Oracle HTTP Server, versions 11.1.1.7.0, 12.1.2.0
Oracle Hyperion Essbase, versions 11.1.2.2, 11.1.2.3
Oracle Hyperion BI+, versions 11.1.2.2, 11.1.2.3
Oracle Hyperion Enterprise Performance Management Architect, versions 11.1.2.2, 11.1.2.3
Oracle Hyperion Common Admin, versions 11.1.2.2, 11.1.2.3
Oracle Hyperion Analytic Provider Services, versions 11.1.2.2, 11.1.2.3
Oracle E-Business Suite Release 11i, version 11.5.10.2
Oracle E-Business Suite Release 12i, versions 12.0.6, 12.1.3, 12.2.2, 12.2.3
Oracle Transportation Management, versions 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3.4
Oracle Agile Product Collaboration, version 9.3.3
Oracle PeopleSoft Enterprise ELS Enterprise Learning Management, versions 9.1, 9.2
Oracle PeopleSoft Enterprise PT PeopleTools, versions 8.52, 8.53
Oracle PeopleSoft Enterprise FIN Install, versions 9.1, 9.2
Oracle PeopleSoft Enterprise SCM Purchasing, versions 9.1, 9.2
Oracle Siebel Travel & Transportation, versions 8.1.1, 8.2.2
Oracle Siebel UI Framework, versions 8.1.1, 8.2.2
Oracle Siebel Core - Server OM Frwks, versions 8.1.1, 8.2.2
Oracle Siebel Core - EAI, versions 8.1.1, 8.2.2
Oracle Communications Messaging Server, version 7.0.5.30.0
Oracle Retail Back Office, versions 8.0, 12.0, 12.0.9IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0
Oracle Retail Central Office, versions 8.0, 12.0, 12.0.9IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0
Oracle Retail Returns Management, versions 2.0, 13.1, 13.2, 13.3, 13.4, 14.0
Oracle Java SE, versions 5.0u65, 6u75, 7u60, 8u5
Oracle JRockit, versions R27.8.2, R28.3.2
Oracle Solaris, versions 8, 9, 10, 11.1
Oracle Secure Global Desktop, versions 4.63, 4.71, 5.0, 5.1
Oracle VM VirtualBox, versions prior to 3.2.24, 4.0.26, 4.1.34, 4.2.26, 4.3.14
Oracle Virtual Desktop Infrastructure (VDI), versions prior to 3.5.1
Sun Ray Software, versions prior to 5.4.3
Oracle MySQL Server, versions 5.5, 5.6
:: Impatto
L'impatto di queste vulnerabilita' varia a seconda del prodotto,
della componente e della configurazione del sistema.
Tra le potenziali conseguenze vi sono attacchi di tipo:
Denial of Service
Manipolazione di dati
Accesso al sistema
Esposizione di informazioni sensibili
Privilege escalation
:: Soluzioni
Applicare le patch appropriate o procedere all'opportuno
aggiornamento secondo le istruzioni rilasciate da Oracle
(vedere link nei Riferimenti)
:: Riferimenti
Oracle Critical Patch Update Advisory - July 2014
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Mitre CVE
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3544
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1739
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2172
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3751
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3774
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4322
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5855
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6450
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0033
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0075
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0096
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0099
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0436
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1492
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2456
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2477
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2479
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2480
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2481
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2482
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2485
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2486
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2487
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2488
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2489
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2492
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2493
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4213
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4215
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4217
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4220
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4222
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4225
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4229
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4230
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4234
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4235
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4236
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4239
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4242
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4246
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4247
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4249
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4250
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4251
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4253
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4254
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4256
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4261
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4265
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4267
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4268
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4271
GARR CERT Newsletter subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iEYEARECAAYFAlPH4VwACgkQwZxMk2USYEInOQCg2mkE6ctE0Yk1g9dOFXzuRhfF
X+UAn1uVo/OY7pikAudqtfvn4sHwHabu
=3AGY
-----END PGP SIGNATURE-----