-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
******************************************************************
Alert ID : GCSA-11003
Data : 20 Gennaio 2011
Titolo : Oracle Critical Patch Update (Gennaio 2011)
******************************************************************
:: Descrizione del problema
Oracle ha rilasciato una Critical Patch Update per il mese di
gennaio 2011 con lo scopo di correggere numerose vulnerabilita'
presenti in vari prodotti e componenti Oracle, Sun Product Suite
e OpenOffice.
:: Software interessato
Oracle Database 11g Release 2, versione 11.2.0.1
Oracle Database 11g Release 1, versione 11.1.0.7
Oracle Database 10g Release 2, versioni 10.2.0.3 e 10.2.0.4, 10.2.0.5
Oracle Database 10g Release 1, versione 10.1.0.5
Oracle Audit Vault 10g Release 2, version 10.2.3.2
Oracle Secure Backup 10g Release 3, version 10.3.0.2
Oracle Fusion Middleware, 11gR1, versioni 11.1.1.2.0, 11.1.1.3.0
Oracle Application Server, 10gR2, versione 10.1.2.3.0
Oracle Beehive, versions 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, 2.0.1.3
Oracle BI Publisher, versioni 10.1.3.3.2, 10.1.3.4.0, 10.1.3.4.1,
11.1.1.3
Oracle Document Capture, versions 10.1.3.4, 10.1.3.5
Oracle GoldenGate Veridata, version 3.0.0.4
Oracle JRockit versions, R27.6.7 and earlier (JDK/JRE 1.4.2, 5, 6),
R28.0.1 and earlier (JDK/JRE 5, 6)
Oracle Outside In Technology, version 8.3.0
Oracle WebLogic Server, versions 7.0.7, 8.1.6, 9.0, 9.1, 9.2.3,
10.0.2, 10.3.2, 10.3.3
Oracle Enterprise Manager Suite Release 10, version 10.2.0.5
Oracle Enterprise Manager Real User Experience Insight, version RUEI 6.0
Oracle E-Business Suite Release 12, versioni 12.0.4, 12.0.5, 12.0.6,
12.1.1, 12.1.2 3 12.1.3
Oracle E-Business Suite Release 11i, versioni 11.5.10.2
Agile Core, versioni 9.3.0.2, 9.3.1
Oracle Transportation Management, versioni 5.5, 6.0, 6.1 e 6.2
PeopleSoft Enterprise CRM versioni 8.9, 9.0 e 9.1
PeopleSoft Enterprise HRMS, versioni 8.9, 9.0 e 9.1
PeopleSoft Enterprise PeopleTools versioni 8.49, 8.50 e 8.51
Oracle Argus Safety, versioni 5.0, 5.0.1, 5.0.2, 5.0.3
Oracle InForm Portal, versions 4.5, 4.6, 5.0
Oracle Sun Product Suite
Oracle Open Office, version 3.2.1 and StarOffice/StarSuite, versioni 7, 8
:: Impatto
Esecuzione remota di codice o comandi arbitrari
Information disclosure
Denial of service
Accesso ad informazioni sensibili
:: Soluzioni
Applicare le patch appropriate o procedere all'opportuno
aggiornamento secondo le istruzioni rilasciate da Oracle
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
:: Riferimenti
Oracle Critical Patch Update Advisory - Gennaio 2010
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
Sun Security Blog
http://blogs.sun.com/security/
Secunia
http://secunia.com/advisories/42919/
http://secunia.com/advisories/42927/
http://secunia.com/advisories/42918/
http://secunia.com/advisories/42921/
http://secunia.com/advisories/42895/
http://secunia.com/advisories/42973/
http://secunia.com/advisories/42925/
http://secunia.com/advisories/42926/
http://secunia.com/advisories/42922/
http://secunia.com/advisories/42970/
http://secunia.com/advisories/42978/
http://secunia.com/advisories/42987/
http://secunia.com/advisories/42992/
http://secunia.com/advisories/42986/
http://secunia.com/advisories/42985/
http://secunia.com/advisories/42984/
http://secunia.com/advisories/42982/
http://secunia.com/advisories/42991/
http://secunia.com/advisories/42981/
http://secunia.com/advisories/42990/
http://secunia.com/advisories/42993/
http://secunia.com/advisories/42989/
http://secunia.com/advisories/42988/
http://secunia.com/advisories/42979/
http://secunia.com/advisories/42977/
http://secunia.com/advisories/42976/
http://secunia.com/advisories/42975/
http://secunia.com/advisories/42974/
http://secunia.com/advisories/42924/
http://secunia.com/advisories/42923/
http://secunia.com/advisories/42920/
http://secunia.com/advisories/42994/
VUPEN
http://www.vupen.com/english/advisories/2011/0139
http://www.vupen.com/english/advisories/2011/0140
http://www.vupen.com/english/advisories/2011/0142
http://www.vupen.com/english/advisories/2011/0143
http://www.vupen.com/english/advisories/2011/0144
http://www.vupen.com/english/advisories/2011/0145
http://www.vupen.com/english/advisories/2011/0146
http://www.vupen.com/english/advisories/2011/0147
http://www.vupen.com/english/advisories/2011/0148
http://www.vupen.com/english/advisories/2011/0149
http://www.vupen.com/english/advisories/2011/0150
http://www.vupen.com/english/advisories/2011/0151
http://www.vupen.com/english/advisories/2011/0152
http://www.vupen.com/english/advisories/2011/0153
http://www.vupen.com/english/advisories/2011/0154
http://www.vupen.com/english/advisories/2011/0155
http://www.vupen.com/english/advisories/2011/0156
http://www.vupen.com/english/advisories/2011/0157
http://www.vupen.com/english/advisories/2011/0158
Mitre's CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2632
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2935
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2936
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3505
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3541
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3548
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3549
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3551
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3553
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3554
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3556
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3557
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3561
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3562
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3566
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3567
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3568
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3569
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3571
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3572
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3573
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3574
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3586
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3587
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3588
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3589
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3590
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3591
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3592
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3593
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3594
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3595
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3596
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3598
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3599
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3600
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3636
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3637
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3639
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3640
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3641
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3642
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3644
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3645
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3649
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3652
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3654
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4413
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4420
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4421
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4423
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4424
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4425
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4426
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4427
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4428
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4429
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4430
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4431
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4432
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4433
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4434
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4435
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4436
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4437
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4438
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4439
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4440
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4441
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4442
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4443
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4444
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4445
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4453
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4455
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4456
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4464
-----BEGIN PGP SIGNATURE-----
iQCVAwUBTTgEIvOB+SpikaiRAQIQsgP/c1IXRsdLBxqqVALeO2hDzoskfgoACR8y
NrpRThrKsEIVT1OHmiF4FASiejgJPb/XQujUT72bsB9gyrYwZ+OwcxEWtoeYgepD
uRXwH5CmDLo23/K+0nPXeKEhLwB08Y89DbhPIMBldDV8Z/b+MT8tVR5Y7X8PLFZ/
dlaXltM+E4k=
=h4bF
-----END PGP SIGNATURE-----