-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
******************************************************************
Alert ID : GCSA-12064
Data : 17 ottobre 2012
Titolo : Oracle Critical Patch Update Advisory (October 2012)
******************************************************************
:: Descrizione del problema
Oracle ha rilasciato la Critical Patch Update October 2012.
L'aggiornamento e' una collezione di patch
che risolvono difetti di sicurezza e non,
presenti in vari prodotti e componenti Oracle.
Sono in corso attacchi che sfruttano con successo
alcune delle vulnerabilita' in questione.
:: Software interessato
Oracle Database 11g Release 2, versions 11.2.0.2, 11.2.0.3
Oracle Database 11g Release 1, version 11.1.0.7
Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5
Oracle Fusion Middleware 11g Release 1, version 11.1.1.6
Oracle Forms and Reports 11g, Release 2, version 11.1.2.0
Oracle Forms and Reports 11g Release 1, version 11.1.1.4
Oracle BI Publisher, versions 10.1.3.4.2, 11.1.1.5.0, 11.1.1.6.0, 11.1.1.6.2
Oracle Event Processing, versions 2.0, 11.1.1.4.0, 11.1.1.6.0
Oracle Identity Management 10g, version 10.1.4.3
Oracle Imaging and Process Management, version 10.1.3.6.0
Oracle JRockit versions, R28.2.4 and earlier, R27.7.3 and earlier
Oracle Outside In Technology, version 8.3.7
Oracle WebLogic Server, versions 9.2.4.0, 10.0.2.0, 10.3.5.0, 10.3.6.0, 12.1.1.0
Oracle WebCenter Sites, versions 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, 11.1.1.6.0
Oracle E-Business Suite Release 12, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3
Oracle E-Business Suite Release 11i, version 11.5.10.2
Oracle Agile PLM For Process, versions 5.2.2, 6.0.0.6.3, 6.1.0.0, 6.1.0.1.14
Oracle Agile PLM Framework, versions 9.3.1.0, 9.3.1.1
Oracle Agile Product Supplier Collaboration for Process, versions 5.2.2, 6.1.0.0
Oracle PeopleSoft Enterprise Campus Solutions, version 9.0
Oracle PeopleSoft Enterprise PeopleTools, versions 8.50, 8.51, 8.52
Oracle Siebel UI Framework, version 8.1.1
Oracle Central Designer, versions 1.3, 1.4, 1.4.2
Oracle Clinical/Remote Data Capture, versions 4.6.0, 4.6.2
Oracle FLEXCUBE Direct Banking, versions 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0-5.3.4, 6.0.1, 6.2.0, 12
Oracle FLEXCUBE Universal Banking, versions 10.0.0-10.5.0, 11.0.0-11.4.0, 12
Oracle Sun Product Suite Oracle Sun Product Suite
Oracle Secure Global Desktop, version 4.6
Oracle VM Virtual Box, versions 3.2, 4.0, 4.1
Oracle MySQL Server, versions 5.1.63 and earlier, 5.5.25 and earlier
:: Impatto
L'impatto di queste vulnerabilita' varia a seconda del prodotto,
della componente e della configurazione del sistema.
Tra le potenziali conseguenze vi sono attacchi di tipo:
Denial of Service
Manipolazione di dati
Accesso al sistema
Attacchi SQL injection
Esecuzione remota di codice arbitrario
Esposizione di informazioni sensibili
:: Soluzioni
Applicare le patch appropriate o procedere all'opportuno
aggiornamento secondo le istruzioni rilasciate da Oracle
(vedere link nei Riferimenti)
:: Riferimenti
Oracle Critical Patch Update Advisory - October 2012
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
Oracle Critical Patch Updates, Security Alerts and Third Party Bulletin
http://www.oracle.com/technetwork/topics/security/alerts-086861.html
Mitre's CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3137
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1751
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3132
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3151
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3146
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3152
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3153
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1411
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1411
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0106
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3183
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3185
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0518
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1686
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0071
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0107
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3184
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0086
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0092
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0095
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3214
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3217
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5065
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3171
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3222
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5058
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3148
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3164
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3162
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5092
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5094
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3161
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3154
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3200
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3182
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3181
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3176
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3179
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3230
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3229
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5066
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1763
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5063
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3141
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5061
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3225
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3157
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5064
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3145
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3189
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0217
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3155
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5095
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3165
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3215
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1685
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3163
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3158
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3177
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3147
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3166
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3173
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3144
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3150
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3180
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3149
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3156
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3167
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3160
-----BEGIN PGP SIGNATURE-----
iD8DBQFQfsObwZxMk2USYEIRApkHAKCXKhOZqmgYSA/zmwx3TPg2hfShagCg0Xwe
z2ONM2vU55JE1ZW7nKYkqAY=
=WxBR
-----END PGP SIGNATURE-----