Oracle Fusion Middleware Flaws Let Remote and Local Users Partially Access and Modify Data and Partially Deny Service
|
|
SecurityTracker Alert ID: 1025799 |
|
SecurityTracker URL: http://securitytracker.com/id/1025799
|
|
CVE Reference:
CVE-2011-0883, CVE-2011-0884, CVE-2011-2241, CVE-2011-2264, CVE-2011-2267
(Links to External Site)
|
Date: Jul 19 2011
|
Impact:
Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Several vulnerabilities reported in Oracle Fusion Middleware. A local or remote user can partially access and modify data and cause partial denial of service conditions on the target system.
A remote authenticated user can exploit a flaw via HTTP in Oracle Containers for J2EE to partially modify data [CVE-2011-0883].
A remote authenticated user can exploit a flaw via HTTP in Oracle BPEL Process Manager to cause partial denial of service conditions [CVE-2011-0884].
A remote user can send specially crafted data via TCP/IP to Oracle Business Intelligence Enterprise Edition to cause partial denial of service conditions [CVE-2011-2241].
A local user can exploit a flaw in Oracle Outside In Technology to partially access and modify data and cause partial denial of service conditions [CVE-2011-2264].
A local user can exploit a flaw in Oracle Outside In Technology to cause partial denial of service conditions [CVE-2011-2267].
The following researchers reported these and other Oracle vulnerabilities:
Abdul-Aziz Hariri, reported through Secunia; Alexander Kornbrust of Red Database Security; Alexandr Polyakov of Digital Security; Brett Gervasoni of Sense of Security; CERT/CC; Dennis Yurichev; Esteban Martinez Fayo of Application Security, Inc.; Guy Pilosof of McAfee Security Research; Laszlo Toth; Michael Myngerbayev of McAfee Security Research; Monarch2020 of unsecurityresearch; Ofer Maor of Hacktics; Okan Basegmez of DORASEC Consulting; Paul M. Wright formerly of NGS Software; Scott Laurie of MWR InfoSecurity; Sow Ching Shiong, reported through Secunia; Steven Seeley of Corelan Team; Sumit Siddharth from 7safe; Tenable Network Security of TippingPoint's Zero Day Initiative; and Will Dormann of CERT/CC.
|
Impact:
A local or remote user can partially access and modify data and cause partial denial of service conditions on the target system.
|
Solution:
The vendor has issued a fix, described in their July 2011 Critical Patch Update advisory.
The vendor's advisory is available at:
http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html
|
Vendor URL: www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 19 Jul 2011 22:01:10 +0000
Subject: Oracle Fusion Middleware
|
CVE-2011-0883
CVE-2011-0884
CVE-2011-2241
CVE-2011-2264
CVE-2011-2267
|
|
