Alert GCSA-06091 - Patch cumulativa per prodotti Oracle (Ottobre

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

      Alert ID: GCSA-06091
      Data di creazione: 18 Ottobre 2006
      Titolo: Patch cumulativa per prodotti Oracle (Ottobre 2006)

******************************************************************


1) Descrizione del problema:

Oracle ha rilasciato una Critical Patch Update per il mese di Ottobre 2006.
Tale aggiornamento e' una collezione di patch nata per porre soluzione a
piu' di cento vulnerabilita' presenti in vari prodotti Oracle.

Il rischio associato a questo aggiornamento e' considerato alto: le
vulnerabilita' potrebbero essere sfruttate da attaccanti remoti o locali
per provocare Denial of Service e attacchi di tipo SQL injection, per eseguire
codice arbitrario, aggirare restrizioni di sicurezza, ottenere l'accesso a 
dati sensibili e permettere la lettura e la scrittura arbitraria di dati.


2) Piattaforme interessate:

Oracle Database 10g Release 2 version 10.2.0.1
Oracle Database 10g Release 2 version 10.2.0.2
Oracle Database 10g Release 1 version 10.1.0.4
Oracle Database 10g Release 1 version 10.1.0.5
Oracle9i Database Release 2 version 9.2.0.6
Oracle9i Database Release 2 version 9.2.0.7
Oracle8i Database Release 3 version 8.1.7.4
Oracle Application Express (formerly called HTML DB) versions 1.5 through 2.0
Oracle Application Server 10g Release 3 version 10.1.3.0.0
Oracle Application Server 10g Release 2 versions 10.1.2.0.0 through 10.1.2.0.2
Oracle Application Server 10g Release 2 version 10.1.2.1.0
Oracle Application Server 10g Release 1 (9.0.4) version 9.0.4.2
Oracle Application Server 10g Release 1 (9.0.4) version 9.0.4.3
Oracle Collaboration Suite 10g Release 1 version 10.1.2.0
Oracle9i Collaboration Suite Release 2 version 9.0.4.2
Oracle E-Business Suite Release 11i versions 11.5.7 through 11.5.10 CU2
Oracle E-Business Suite Release 11.0
Oracle Pharmaceutical Applications versions 4.5.0 through 4.5.1
Oracle PeopleSoft Enterprise PeopleTools version 8.22
Oracle PeopleSoft Enterprise PeopleTools version 8.46
Oracle PeopleSoft Enterprise PeopleTools version 8.47
Oracle PeopleSoft Enterprise PeopleTools version 8.48
Oracle PeopleSoft Enterprise Portal Solutions and Enterprise Portal version 8.8
Oracle PeopleSoft Enterprise Portal Solutions and Enterprise Portal version 8.9
JD Edwards EnterpriseOne Tools version 8.95
JD Edwards EnterpriseOne Tools version 8.96
JD Edwards OneWorld Tools SP23
Oracle Developer Suite versions 6i 9.0.4.1
Oracle Developer Suite versions 6i 9.0.4.2
Oracle Developer Suite versions 6i 9.0.4.3
Oracle Developer Suite versions 6i 10.1.2.0.2
Oracle Developer Suite versions 6i 10.1.2.2
Oracle9i Database Release 1 version 9.0.1.4
Oracle9i Database Release 1 version 9.0.1.5
Oracle9i Database Release 1 version 9.0.1.5 FIPS
Oracle9i Application Server Release 2 version 9.0.2.3
Oracle9i Application Server Release 2 version 9.0.3.1
Oracle9i Application Server Release 1 version 1.0.2.2
Oracle Database 10g Release 1 version 10.1.0.3
Oracle9i Database Release 2 version 9.2.0.5
Oracle Application Server 10g Release 1 (9.0.4) version 9.0.4.1


3) Impatto:

L'impatto di queste vulnerabilita' varia in base alla configurazione del
sistema ed a seconda del prodotto o della componente considerata.


4) Soluzioni:

Applicare le patch appropriate o procedere ad opportuno aggiornamento secondo
le istruzioni rilasciate da Oracle:

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2006.html


5) Riferimenti:

Critical Patch Update - October 2006 -
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2006.html

FrSirt:
http://www.frsirt.com/english/advisories/2006/4065

-----BEGIN PGP SIGNATURE-----

iQCVAwUBRTX8BvOB+SpikaiRAQJ2BgQA1Vp0R3DI9NKu4+/ASDmWzIYI3B5KjgRt
1+t2rccZMsS6k2/Ov6pfQ0ohwaOOZxjOyUXEolll2NESVa2rxtego2WiPK5lgh/0
zYOxmhqKowxL6wVf34fMLwF+VqP0ARn3n2CelZkHfqc0zmMRznzyngx4AxSQh/Av
XmJpWBNq9Gk=
=Mc1I
-----END PGP SIGNATURE-----