Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 18, 2012

Oracle PeopleSoft Enterprise Supply Chain Management (SCM) Unspecified Vulnerabilities

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Oracle PeopleSoft Enterprise Supply Chain Management (SCM) 9.x

Description:
Two vulnerabilities have been reported in Oracle PeopleSoft Enterprise Supply Chain Management, which can be exploited by malicious users to disclose sensitive information and manipulate certain data.

1) An unspecified error in the eProcurement sub-component can be exploited to manipulate certain data via specially crafted HTTP requests.

2) An unspecified error in the Billing sub-component can be exploited to disclose certain data via specially crafted HTTP requests.

The vulnerabilities are reported in versions 9.0 and 9.1.

Solution:
Apply patch (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported the vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html

http://secunia.com/advisories/48884/

Oracle FLEXCUBE Universal Banking Unspecified Vulnerabilities

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Manipulation of data
Exposure of sensitive information
DoS
Where : From remote
Solution Status : Vendor Patch

Software: Oracle FLEXCUBE Universal Banking 10.x
Oracle FLEXCUBE Universal Banking 11.x

Description:
Multiple vulnerabilities have been reported in Oracle FLEXCUBE Universal Banking, which can be exploited by malicious users and malicious people to disclose sensitive information, manipulate certain data, and cause a DoS (Denial of Service).

1) An unspecified error in the Core sub-component can be exploited to disclose and manipulate certain data via specially crafted HTTP requests.

2) Another unspecified error in the Core sub-component can be exploited to disclose and manipulate certain data via specially crafted HTTP requests.

3) An unspecified error in the Core sub-component can be exploited to disclose and manipulate certain data via specially crafted HTTP requests.

4) An unspecified error in the Core sub-component can be exploited to disclose and manipulate certain data and cause a DoS via specially crafted HTTP requests.

5) An unspecified error in the Core sub-component can be exploited to manipulate certain data via specially crafted HTTP requests.

6) An unspecified error in the Core sub-component can be exploited to manipulate certain data via specially crafted HTTP requests.

7) An unspecified error in the Core sub-component can be exploited to disclose and manipulate certain data via specially crafted HTTP requests.

8) An unspecified error in the Core sub-component can be exploited to cause a DoS via specially crafted HTTP requests.

9) An unspecified error in the Core sub-component can be exploited to disclose certain application data via specially crafted HTTP requests.

The vulnerabilities are reported in versions 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0.

Solution:
Apply patch (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported the vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html

http://secunia.com/advisories/48831/

Release Date : 2012-04-18

Criticality level : Moderately critical
Impact : Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Oracle Agile PLM (Product Lifecycle Management) 6.x

Description:
Multiple vulnerabilities have been reported in Oracle Agile PLM, which can be exploited by malicious users to disclose potentially sensitive information and manipulate certain data and by malicious people to manipulate certain data.

1) An unspecified error in the Install component can be exploited by authenticated users to read, update, insert, or delete certain Oracle Agile accessible data.

2) An unspecified error in the Supplier Portal component can be exploited to update, insert, or delete certain Oracle Agile accessible data.

3) An unspecified error in the SCRM - Company Profiles component can be exploited to update, insert, or delete certain Oracle Agile accessible data.

The vulnerabilities are reported in version 6.0.0.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported these vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSCP

http://secunia.com/advisories/48874/

Release Date : 2012-04-18

Criticality level : Not critical
Impact : DoS
Where : Local system
Solution Status : Vendor Patch

Operating System: Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for the kernel. This fixes multiple vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2012:0481-01:
https://rhn.redhat.com/errata/RHSA-2012-0481.html

http://secunia.com/advisories/48842/

Oracle iPlanet Web Server Multiple Cross-Site Scripting Vulnerabilities

Release Date : 2012-04-18

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Oracle iPlanet Web Server 7.x

Description:
Sow Ching Shiong has reported multiple vulnerabilities in Oracle iPlanet Web Server, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain input passed to the administration console is not properly sanitised before being returned to the user. This can can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in version 7.0.9 B07/04/2010 02:06. Other versions may also be affected.

Solution:
Patches are scheduled to be released on 30th April 2012.

Provided and/or discovered by:
Sow Ching Shiong via Secunia.

Original Advisory:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS

http://secunia.com/advisories/43942/