Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 18, 2012

Oracle PeopleSoft Human Capital Management Human Resources Unspecified Vulnerability

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Exposure of sensitive information
Where : From local network
Solution Status : Vendor Patch

Software: Oracle PeopleSoft Human Capital Management (HCM) 9.x

Description:
A vulnerability has been reported in Oracle PeopleSoft Human Capital Management, which can be exploited by malicious users to disclose potentially sensitive information.

The vulnerability is caused due to an unspecified error in the Human Resources component and can be exploited to read certain PeopleSoft Enterprise HCM accessible data.

The vulnerability is reported in version 9.1 Bundle #9.

Solution:
Apply update (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported this vulnerability as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixPS

http://secunia.com/advisories/48877/

Oracle Identity Manager User Config Management Unspecified Vulnerability

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Exposure of sensitive information
Where : From local network
Solution Status : Vendor Patch

Software: Oracle Identity Manager 11g

Description:
A vulnerability has been reported in Oracle Identity Manager, which can be exploited by malicious users to disclose potentially sensitive information and manipulate certain data.

The vulnerability is caused due to an unspecified error in the User Config Management component and can be exploited to read, update, insert, or delete Identity Manager accessible data.

The vulnerability is reported in version 11.1.1.3 and 11.1.1.5.

Solution:
Apply update (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported this vulnerability as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixFMW

http://secunia.com/advisories/48861/

Release Date : 2012-04-18

Criticality level : Moderately critical
Impact : Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Oracle E-Business Suite 12.x

Description:
Multiple vulnerabilities have been reported in Oracle E-Business Suite, which can be exploited by malicious people to disclose potentially sensitive information and manipulate certain data.

1) An unspecified error within the HTML pages subcomponent of the Oracle Application Object Library can be exploited to disclose and manipulate certain library data.

2) An unspecified error within the Change Password Page subcomponent of the Oracle Application Object Library can be exploited to disclose certain library data.

3) An unspecified error within the REST Services subcomponent of the Oracle Application Object Library can be exploited to manipulate certain library data.

4) An unspecified error within the Runtime Catalog subcomponent of the Oracle iStore component can be exploited to manipulate certain iStore data.

Please see the vendor's advisory for a list of affected versions.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixEBS

http://secunia.com/advisories/48871/

Release Date : 2012-04-18

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Software: MySQL 5.x

Description:
Multiple vulnerabilities have been reported in Oracle MySQL Server, which can be exploited by malicious users to cause a DoS (Denial of Service).

1) An unspecified error in the Server Optimizer component can be exploited to cause a crash.

2) An unspecified error in the MyISAM component can be exploited to cause a crash.

3) An unspecified error in the Partition component can be exploited to cause a crash.

4) An unspecified error in the Server DML component can be exploited to cause a crash.

5) An unspecified error in the Server Optimizer component can be exploited to cause a crash.

6) An unspecified error in the Server Optimizer component can be exploited to cause a crash.

Please see the vendor's advisory for a list of affected versions.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixMSQL

http://secunia.com/advisories/48890/

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Where : From local network
Solution Status : Vendor Patch

Software: Oracle BI Publisher 10.x

Description:
A vulnerability has been reported in Oracle BI Publisher, which can be exploited by malicious people to manipulate certain data.

The vulnerability is caused due to an unspecified error in the Administration component and can be exploited to update, insert, or delete certain BI Publisher accessible data.

The vulnerability is reported in versions 10.1.3.4.1 and 10.1.3.4.2.

Solution:
Apply update (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported this vulnerability as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixFMW

http://secunia.com/advisories/48857/

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Where : From local network
Solution Status : Vendor Patch

Software: Oracle PeopleSoft Enterprise Customer Relationship Management (CRM) 9.x

Description:
A vulnerability has been reported in Oracle PeopleSoft Enterprise CRM, which can be exploited by malicious people to manipulate certain data.

The vulnerability is caused due to an unspecified error within the SEC component. No further information is currently available.

The vulnerability is reported in version 9.1.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported the vulnerability as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporters provide more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixPS

http://secunia.com/advisories/48876/

Oracle PeopleSoft Enterprise PeopleTools Multiple Vulnerabilities

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Privilege escalation
System access
Manipulation of data
Exposure of sensitive information
Where : From local network
Solution Status : Vendor Patch

Software: Oracle PeopleSoft PeopleTools 8.x

Description:
Multiple vulnerabilities have been reported in Oracle PeopleSoft Enterprise PeopleTools, which can be exploited by malicious, local users to gain escalated privileges, by malicious users to disclose potentially sensitive information, manipulate certain data, and compromise a vulnerable system, and by malicious people to manipulate certain data.

1) An unspecified error in the Query component can be exploited by authenticated users to potentially execute arbitrary code.

2) An unspecified error in the Search component can be exploited by authenticated users to disclose and manipulate all PeopleTools accessible data.

3) An unspecified error in the Portal component can be exploited to manipulate certain PeopleTools accessible data.

4) An unspecified error in the PIA Core Technology component can be exploited by authenticated users to manipulate certain PeopleTools accessible data.

5) An unspecified error in the core component can be exploited by authenticated users to manipulate certain PeopleTools accessible data.

6) An unspecified error in the File Processing component can be exploited by local users to escalate their privileges.

The vulnerabilities are reported in versions 8.50, 8.51, and 8.52.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixPS

http://secunia.com/advisories/48882/

Oracle Enterprise Manager Grid Control Multiple Vulnerabilities

Release Date : 2012-04-18

Criticality level : Moderately critical
Impact : Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Oracle Enterprise Manager 10.x
Oracle Enterprise Manager 11.x

Description:
Multiple vulnerabilities have been reported in Oracle Enterprise Manager Grid Control, which can be exploited by malicious users and malicious people to disclose potentially sensitive information and manipulate certain data.

1) An unspecified error within the Security Framework subcomponent of the Enterprise Manager Base Platform component can be exploited to disclose and manipulate certain Base Platform accessible data.

2) An unspecified error within the Enterprise Config Management subcomponent of the Enterprise Manager Base Platform component can be exploited by authenticated users to disclose and manipulate all Base Platform accessible data.

3) An unspecified error within the Enterprise Config Management subcomponent of the Enterprise Manager Base Platform component can be exploited by authenticated users to disclose and manipulate all Base Platform accessible data.

4) An unspecified error within the Schema Management subcomponent of the Enterprise Manager Base Platform component can be exploited to manipulate certain Base Platform accessible data.

5) An unspecified error within the Schema Management subcomponent of the Enterprise Manager Base Platform component can be exploited to manipulate certain Base Platform accessible data.

6) An unspecified error within the Security Framework subcomponent of the Enterprise Manager Base Platform component can be exploited to manipulate certain Base Platform accessible data.

Please see the vendor's advisory for a list of affected versions.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixEM

http://secunia.com/advisories/48870/

Release Date : 2012-04-18

Criticality level : Moderately critical
Impact : Manipulation of data
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Software: Oracle Database 10.x
Oracle Database 11.x

Description:
Multiple vulnerabilities have been reported in Oracle Database, which can be exploited by malicious users to compromise a vulnerable system, by malicious users and malicious people to disclose potentially sensitive information and manipulate certain data, and by malicious people to cause a DoS (Denial of Service).

1) An error in the Oracle Spatial component can be exploited by authenticated users to execute arbitrary code.

Successful exploitation of this vulnerability requires Create session, create index, alter index, and create table privileges.

2) An error in the Core RDBMS component can be exploited by authenticated users to execute arbitrary code.

Successful exploitation of this vulnerability requires create library and create procedure privileges.

3) Another error in the Core RDBMS component can be exploited to manipulate certain Core RDBMS accessible data and cause a DoS.

4) An error in the OCI component can be exploited to disclose or manipulate certain data.

5) Some errors exist within Enterprise Manager Grid Control.

6) An error in the Application Express component can be exploited to manipulate certain data.

7) An error within the RDBMS Core component can be exploited by authenticated users to manipulate certain data.

Successful exploitation of this vulnerability requires Create Session privileges.

The vulnerabilities are reported in the following products and versions:
* Oracle Database 11g Release 2 versions 11.2.0.2 and 11.2.0.3
* Oracle Database 11g Release 1 version 11.1.0.7
* Oracle Database 10g Release 2 versions 10.2.0.3, 10.2.0.4, and 10.2.0.5

Solution:
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixDB

http://secunia.com/advisories/48855/

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Privilege escalation
System access
Where : From local network
Solution Status : Vendor Patch

Software: Oracle Grid Engine 6.x

Description:
Two vulnerabilities have been reported in Oracle Grid Engine, which can be exploited by malicious, local users to gain escalated privileges and by malicious users to compromise a vulnerable system.

1) An unspecified error within the qrsh component can be exploited by authenticated users to execute arbitrary code.

2) An unspecified error within the sgepasswd component can be exploited by local users to gain escalated privileges.

The vulnerabilities are reported in versions 6.1 and 6.2.

Solution:
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS

http://secunia.com/advisories/48826/

Release Date : 2012-04-18

Criticality level : Highly critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Gentoo Linux

Description:
Gentoo has issued an update for freetype. This fixes multiple vulnerabilities, which can be exploited by malicious people to potentially compromise an application using the library.

Solution:
Update to "media-libs/freetype-2.4.9" or later.

Original Advisory:
GLSA 201204-04:
http://security.gentoo.org/glsa/glsa-201204-04.xml

http://secunia.com/advisories/48822/

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Exposure of sensitive information
Privilege escalation
Where : From remote
Solution Status : Vendor Patch

Operating System: Oracle Solaris 11.x
Sun Solaris 10.x
Sun Solaris 8.x
Sun Solaris 9.x

Description:
Multiple vulnerabilities have been reported in Oracle Solaris, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and gain escalated privileges and by malicious people to disclose potentially sensitive information and manipulate certain data.

1) An unspecified error in the bsmconv and bsmunconv components can be exploited by local users to gain escalated privileges.

2) An unspecified error in the Kernel/sockfs component can be exploited by local users to cause a crash.

3) An unspecified error in the gssd component can be exploited by local users to gain escalated privileges.

4) An unspecified error in the Password Policy component can be exploited by local users to gain escalated privileges.

5) An unspecified error in the Kernel/Privileges component can be exploited by local users to gain escalated privileges.

6) An unspecified error in the SCTP component can be exploited by local users to cause a crash.

7) An unspecified error in the libsasl component can be exploited to read, update, insert, or delete certain Solaris accessible data.

8) An unspecified error in the Kernel/GLD component can be exploited by authenticated users to read certain Solaris accessible data.

The vulnerabilities are reported in versions 8, 9, 10, and 11.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported the vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporters provide more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS

http://secunia.com/advisories/48809/

PARC Enterprise M Series XSCF Control Package Vulnerabilities

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Exposure of sensitive information
DoS
Where : From local network
Solution Status : Vendor Patch

Operating System: Sun SPARC Enterprise Server M Series

Description:
Two vulnerabilities have been reported in SPARC Enterprise M Series, which can be exploited by malicious, local users to disclose sensitive information and by malicious people to cause a DoS (Denial of Service).

1) An unspecified error in the XSCF Control Package (XCP) component can be exploited to cause a crash via specially crafted SSH requests.

2) An unspecified error in the XSCF Control Package (XCP) component can be exploited by local users to gain access to a subset of SPARC Enterprise M Series Servers accessible data.

The vulnerabilities are reported in SPARC Enterprise M Series Servers running XCP 1110 and prior.

Solution:
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS

http://secunia.com/advisories/48837/

Release Date : 2012-04-18

Criticality level : Highly critical
Impact : Security Bypass
Cross Site Scripting
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: Gentoo Linux

Description:
Gentoo has issued an update for adobe-flash. This fixes multiple vulnerabilities, which can be exploited by malicious people to conduct cross-site scripting attacks, gain knowledge of potentially sensitive information, bypass certain security restrictions, and compromise a user's system.

Solution:
Update to "www-plugins/adobe-flash-11.2.202.228" or later.

Original Advisory:
GLSA 201204-07:
http://security.gentoo.org/glsa/glsa-201204-07.xml

http://secunia.com/advisories/48819/

Oracle PeopleSoft Enterprise Human Resource Management System (HRMS) Unspecified Vulnerabilities

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Oracle PeopleSoft Enterprise Human Resource Management System (HRMS) 8.x
Oracle PeopleSoft Enterprise Human Resource Management System (HRMS) 9.x

Description:
Multiple vulnerabilities have been reported in Oracle PeopleSoft Enterprise Human Resource Management System, which can be exploited by malicious users to disclose sensitive information and manipulate certain data.

1) An unspecified error in the eCompensation Manager Desktop sub-component can be exploited to disclose and manipulate certain data via specially crafted HTTP requests.

This vulnerability is reported in version 9.0.

2) An unspecified error in the eCompensation sub-component can be exploited to disclose certain data via specially crafted HTTP requests.

This vulnerability is reported in version 8.9 through Bundle #26.

3) An unspecified error in the Candidate Gateway sub-component can be exploited to disclose certain data via specially crafted HTTP requests.

This vulnerability is reported in version 9.1.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported the vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html

http://secunia.com/advisories/48878/