세상 편리한 보안 이야기

2017년 7월 Oracle Critical Patch Update 권고

보안업데이트 2017. 7. 19. 12:25

오라클社 CPU에서 자사 제품의 보안취약점 308개에 대한 패치를 발표[1]
※ CPU(Critical Patch Update) : 오라클 중요 보안 업데이트
o 영향 받는 버전의 사용자는 악성코드 감염에 취약할 수 있으므로, 아래 해결방안에 따라 최신버전으로 업데이트 권고

□ 영향을 받는 시스템
o Oracle Database Server, versions 11.2.0.4, 12.1.0.2, 12.2.0.1
o Oracle REST Data Services, versions prior to 3.0.10.25.02.36
o Oracle API Gateway, version 11.1.2.4.0
o Oracle BI Publisher, versions 11.1.1.7.0, 11.1.1.9.0, 12.2.1.1.0, 12.2.1.2.0
o Oracle Business Intelligence Enterprise Edition, versions 11.1.1.9.0, 12.2.1.1.0, 12.2.1.2.0
o Oracle Data Integrator, versions 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.0.0
o Oracle Endeca Server, versions 7.3.0.0, 7.4.0.0, 7.5.0.0, 7.5.1.0, 7.6.0.0, 7.6.1.0, 7.7.0.0
o Oracle Enterprise Data Quality, version 8.1.13.0.0
o Oracle Enterprise Repository, versions 11.1.1.7.0, 12.1.3.0.0
o Oracle Fusion Middleware, versions 11.1.1.7, 11.1.1.9, 11.1.2.2, 11.1.2.3, 12.1.3.0, 12.2.1.1, 12.2.1.2
o Oracle OpenSSO, version 3.0.0.8
o Oracle Outside In Technology, version 8.5.3.0
o Oracle Secure Enterprise Search, version 11.2.2.2.0
o Oracle Service Bus, version 11.1.1.9.0
o Oracle Traffic Director, versions 11.1.1.7.0, 11.1.1.9.0
o Oracle Tuxedo, version 12.1.1
o Oracle Tuxedo System and Applications Monitor, versions 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0, 12.2.2.0.0
o Oracle WebCenter Content, versions 11.1.1.9.0, 12.2.1.1.0, 12.2.1.2.0
o Oracle WebLogic Server, versions 10.3.6.0, 12.1.3.0, 12.2.1.1, 12.2.1.2
o Hyperion Essbase, version 12.2.1.1
o Enterprise Manager Base Platform, versions 12.1.0, 13.1.0, 13.2.0
o Enterprise Manager Ops Center, versions 12.2.2, 12.3.2
o Oracle Application Testing Suite, versions 12.5.0.2, 12.5.0.3
o Oracle Business Transaction Management, versions 11.1.x, 12.1.x
o Oracle Configuration Manager, versions prior to 12.1.2.0.4
o Application Management Pack for Oracle E-Business Suite, versions AMP 12.1.0.4.0, AMP 13.1.1.1.0
o Oracle E-Business Suite, versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6
o Oracle Agile PLM, versions 9.3.5, 9.3.6
o Oracle Transportation Management, versions 6.1, 6.2, 6.3.4.1, 6.3.5.1, 6.3.6.1, 6.3.7.1, 6.4.0, 6.4.1,
6.4.2
o PeopleSoft Enterprise FSCM, version 9.2
o PeopleSoft Enterprise PeopleTools, versions 8.54, 8.55
o PeopleSoft Enterprise PRTL Interaction Hub, version 9.1.0
o Siebel Applications, versions 16.0, 17.0
o Oracle Commerce Guided Search / Oracle Commerce Experience Manager, versions 6.1.4, 11.0,
11.1, 11.2
o Oracle iLearning, version 6.2
o Oracle Fusion Applications, versions 11.1.2 through 11.1.9
o Oracle Communications BRM, versions 11.2.0.0.0, 11.3.0.0.0
o Oracle Communications Convergence, versions 3.0, 3.0.1
o Oracle Communications EAGLE LNP Application Processor, version 10.0
o Oracle Communications Network Charging and Control, versions 4.4.1.5, 5.0.0.1, 5.0.0.2, 5.0.1.0,
5.0.2.0
o Oracle Communications Policy Management, version 11.5
o Oracle Communications Session Router, versions ECZ730, SCZ730, SCZ740
o Oracle Enterprise Communications Broker, version PCZ210
o Oracle Enterprise Session Border Controller, version ECZ7.3.0
o Financial Services Behavior Detection Platform, versions 8.0.1, 8.0.2
o Oracle Banking Platform, versions 2.3, 2.4, 2.4.1, 2.5
o Oracle FLEXCUBE Direct Banking, versions 12.0.2, 12.0.3
o Oracle FLEXCUBE Private Banking, versions 2.0.0, 2.0.1, 2.2.0, 12.0.1
o Oracle FLEXCUBE Universal Banking, versions 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0
o Hospitality Hotel Mobile, versions 1.01, 1.05, 1.1
o Hospitality Property Interfaces, version 8.10.x
o Hospitality Suite8, version 8.10.x
o Hospitality WebSuite8 Cloud Service, versions 8.9.6, 8.10.x
o MICROS BellaVita, version 2.7.x
o MICROS PC Workstation 2015, versions Prior to O1302h
o MICROS Workstation 650, versions Prior to E1500n
o Oracle Hospitality 9700, version 4.0
o Oracle Hospitality Cruise AffairWhere, version 2.2.05.062
o Oracle Hospitality Cruise Dining Room Management, version 8.0.75
o Oracle Hospitality Cruise Fleet Management, version 9.0
o Oracle Hospitality Cruise Materials Management, version 7.30.562
o Oracle Hospitality Cruise Shipboard Property Management System, version 8.0.0.0
o Oracle Hospitality e7, version 4.2.1
o Oracle Hospitality Guest Access, versions 4.2.0.0, 4.2.1.0
o Oracle Hospitality Inventory Management, versions 8.5.1, 9.0.0
o Oracle Hospitality Materials Control, versions 8.31.4, 8.32.0
o Oracle Hospitality OPERA 5 Property Services, versions 5.4.0.x, 5.4.1.x, 5.4.3.x
o Oracle Hospitality Reporting and Analytics, versions 8.5.1, 9.0.0
o Oracle Hospitality RES 3700, version 5.5
o Oracle Hospitality Simphony, versions 2.8, 2.9
o Oracle Hospitality Simphony First Edition, version 1.7.1
o Oracle Hospitality Simphony First Edition Venue Management, version 3.9
o Oracle Hospitality Suites Management, version 3.7
o Oracle Payment Interface, version 6.1.1
o Oracle Retail Allocation, versions 13.3.1, 14.0.4, 14.1.3, 15.0.1, 16.0.1
o Oracle Retail Customer Insights, versions 15.0, 16.0
o Oracle Retail Open Commerce Platform, versions 5.0, 5.1, 5.2, 5.3, 6.0, 6.1, 15.0, 15.1
o Oracle Retail Warehouse Management System, versions 14.0.4, 14.1.3, 15.0.1
o Oracle Retail Workforce Management, versions 1.60.7, 1.64.0
o Oracle Retail Xstore Point of Service, versions 6.0.x, 6.5.x, 7.0.x, 7.1.x, 15.0.x, 16.0.0
o Oracle Policy Automation, versions 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.2.2, 12.2.3
o Primavera Gateway, versions 1.0, 1.1, 14.2, 15.1, 15.2, 16.1, 16.2
o Primavera P6 Enterprise Project Portfolio Management, versions 8.3, 8.4, 15.1, 15.2, 16.1, 16.2
o Primavera Unifier, versions 9.13, 9.14, 10.1, 10.2, 15.1, 15.2, 16.1, 16.2
o Java Advanced Management Console, version 2.6
o Oracle Java SE, versions 6u151, 7u141, 8u131
o Oracle Java SE Embedded, version 8u131
o Oracle JRockit, version R28.3.14
o Solaris, versions 10, 11
o Solaris Cluster, version 4
o Sun ZFS Storage Appliance Kit (AK), version AK 2013
o Oracle VM VirtualBox, versions prior to 5.1.24
o MySQL Cluster, versions 7.3.5 and prior
o MySQL Connectors, versions 5.3.7 and prior, 6.1.10 and prior
o MySQL Enterprise Monitor, versions 3.1.5.7958 and prior, 3.2.5.1141 and prior, 3.2.7.1204 and
prior, 3.3.2.1162 and prior, 3.3.3.1199 and prior
o MySQL Server, versions 5.5.56 and prior, 5.6.36 and prior, 5.7.18 and prior
o Oracle Explorer, versions prior to 8.16
※ 영향받는 시스템의 상세 정보는 참고사이트[1]를 참조

□ 해결 방안
o "Oracle Critical Patch Update Advisory - July 2017“ 문서 및 패치사항을 검토하고 벤더사 및 유지보수 업체와
협의/검토 후 패치 적용[1]
o JAVA SE 사용자는 설치된 제품의 최신 업데이트를 다운로드[2] 받아 설치하거나, Java 업데이트 자동 알림 설정을 권고[3]

[참고사이트]
[1] http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
[2] http://www.oracle.com/technetwork/java/javase/downloads/index.html
[3] http://www.java.com/ko/download/help/java_update.xml

저작자표시 비영리 변경금지 (새창열림)

'보안업데이트' 카테고리의 다른 글

Cisco WebEx Browser Extension 취약점 보안 업데이트 권고 (0)	2017.07.19
Apache httpd 2.4.26 mod_http2.c Read-After-Free 업데이트 권고 (0)	2017.07.14
ScreenOS: Multiple XSS vulnerabilities in ScreenOS Firewall (0)	2017.07.14
Samba Releases Security Updates (0)	2017.07.13
Microsoft Releases July 2017 Security Updates (0)	2017.07.12

Ryansecurity

널리 이롭게 하자 [홍익 인간]

Cisco WebEx Browser Extension 취약점 보안 업데이트 권고

보안업데이트 2017. 7. 19. 12:22

Cisco社는 자사의 제품에 영향을 주는 취약점을 해결한 보안 업데이트 발표
o 공격자는 해당 취약점을 악용하여 원격 코드 실행의 피해를 발생시킬 수 있으므로 최신 버전으로 업데이트 권고

□ 설명
o Cisco WebEx Browser Extension에서 인증되지 않은 사용자가 브라우저 권한으로 원격 코드 실행이 가능한 취약점
(CVE-2017-6753)[2]

□ 영향을 받는 제품
o 참고사이트에 명시되어 있는 ‘Affected Products’를 통해 취약한 제품 확인
o Google Chrome
- Cisco WebEx extension 1.0.12 이전 버전
o Mozilla Firefox
- Cisco WebEx extension 1.0.12 이전 버전

□ 해결 방안
o 취약점이 발생한 Cisco WebEx 소프트웨어가 설치된 이용자는, 해당되는 참고사이트에 명시되어 있는 ‘Affected Products’
내용을 확인하여, 패치 적용

[참고사이트]
[1] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170717-webex
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6753
[3] http://www.securityfocus.com/bid/99614

저작자표시 비영리 변경금지 (새창열림)

'보안업데이트' 카테고리의 다른 글

2017년 7월 Oracle Critical Patch Update 권고 (0)	2017.07.19
Apache httpd 2.4.26 mod_http2.c Read-After-Free 업데이트 권고 (0)	2017.07.14
ScreenOS: Multiple XSS vulnerabilities in ScreenOS Firewall (0)	2017.07.14
Samba Releases Security Updates (0)	2017.07.13
Microsoft Releases July 2017 Security Updates (0)	2017.07.12

Ryansecurity

널리 이롭게 하자 [홍익 인간]

Apache httpd 2.4.26 mod_http2.c Read-After-Free 업데이트 권고

보안업데이트 2017. 7. 14. 17:38

CVE-2017-9789: Read after free in mod_http2.c

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
httpd 2.4.26

Description:
When under stress, closing many connections, the HTTP/2
handling code would sometimes access memory after it has
been freed, resulting in potentially erratic behaviour.

Mitigation:
2.4.26 users of mod_http2 should upgrade to 2.4.27.

Credit:
The Apache HTTP Server security team would like to thank Robert AwiAcki
for reporting this issue.

References:
https://httpd.apache.org/security_report.html

important: ap_get_basic_auth_pw() Authentication Bypass CVE-2017-3167


Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.34 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request.
Acknowledgements: We would like to thank Emmanuel Dreyfus for reporting this issue.
Reported to security team: 6th February 2017
Issue public: 19th June 2017
Update Released: 19th June 2017
Affects: 2.4.25, 2.4.23, 2.4.20, 2.4.18, 2.4.17, 2.4.16, 2.4.12, 2.4.10, 2.4.9, 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, 2.4.1


important: mod_ssl Null Pointer Dereference CVE-2017-3169


mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
Acknowledgements: We would like to thank Vasileios Panopoulos and AdNovum Informatik AG for reporting this issue.
Reported to security team: 5th December 2016
Issue public: 19th June 2017
Update Released: 19th June 2017
Affects: 2.4.25, 2.4.23, 2.4.20, 2.4.18, 2.4.17, 2.4.16, 2.4.12, 2.4.10, 2.4.9, 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, 2.4.1

important: mod_http2 Null Pointer Dereference CVE-2017-7659


A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process.
Acknowledgements: We would like to thank Robert Święcki for reporting this issue.
Reported to security team: 18th November 2016
Issue public: 19th June 2017
Update Released: 19th June 2017
Affects: 2.4.25

important: ap_find_token() Buffer Overread CVE-2017-7668


The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
Acknowledgements: We would like to thank Javier Jiménez (javijmor@gmail.com) for reporting this issue.
Reported to security team: 6th May 2017
Issue public: 19th June 2017
Update Released: 19th June 2017
Affects: 2.4.25


important: mod_mime Buffer Overread CVE-2017-7679


mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
Acknowledgements: We would like to thank ChenQin and Hanno Böck for reporting this issue.

저작자표시 비영리 변경금지 (새창열림)

'보안업데이트' 카테고리의 다른 글

2017년 7월 Oracle Critical Patch Update 권고 (0)	2017.07.19
Cisco WebEx Browser Extension 취약점 보안 업데이트 권고 (0)	2017.07.19
ScreenOS: Multiple XSS vulnerabilities in ScreenOS Firewall (0)	2017.07.14
Samba Releases Security Updates (0)	2017.07.13
Microsoft Releases July 2017 Security Updates (0)	2017.07.12

Ryansecurity

널리 이롭게 하자 [홍익 인간]

2017년 7월 Oracle Critical Patch Update 권고

'보안업데이트' 카테고리의 다른 글

Cisco WebEx Browser Extension 취약점 보안 업데이트 권고

'보안업데이트' 카테고리의 다른 글

Apache httpd 2.4.26 mod_http2.c Read-After-Free 업데이트 권고

'보안업데이트' 카테고리의 다른 글

공지사항

카테고리

태그목록

글 보관함

달력

링크

Ryansecurity

LATEST FROM OUR BLOG

LATEST COMMENTS

BLOG VISITORS

티스토리툴바

« 2026/09 »
일	월	화	수	목	금	토
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30