CSIRT-CV - Hemeroteca

Está usted visitando una publicación en la hemeroteca de CSIRT-CV.
Para acceder al portal y contenido actual, visite https://www.csirtcv.gva.es

18/07/2019

Actualizaciones críticas de Oracle julio 2019

Se han publicado varias actualizaciones críticas de productos Oracle

Riesgo: Crítico

Hasta un total de 319 vulnerabilidades han sido corregidas con las actualizaciones publicadas por Oracle en el mes de julio. Dichas vulnerabilidades afectan a numerosos productos.

Sistemas Afectados:

Application Express, versiones 5.1, 18.2;
Diagnostic Assistant, versiones anteriores a 2.12.36;
Enterprise Manager Base Platform, versiones 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0;
Enterprise Manager para Fusion Middleware, versiones 13.2, 13.3;
Enterprise Manager para Virtualization, versiones 13.1, 13.2, 13.3;
Enterprise Manager Ops Center, versiones 12.3.3, 12.4.0;
Instantis EnterpriseTrack, versiones 17.1, 17.2, 17.3;
JD Edwards EnterpriseOne Tools, versión 9.2;
JD Edwards World Security, versiones A9.3, A9.3.1, A9.4;
MICROS Retail XBRi Loss Prevention, versiones 10.8.0 - 10.8.3;
MICROS Retail-J, versiones 12.1.0, 12.1.1, 12.1.2, 13.1;
MySQL Enterprise Monitor, versiones 4.0.9 y anteriores, 8.0.14 y anteriores;
MySQL Server, versiones 5.6.44 y anteriores, 5.7.26 y anteriores, 8.0.16 y anteriores;
MySQL Workbench, versiones 8.0.16 y anteriores;
Oracle Agile Engineering Data Management, versiones 6.2.0, 6.2.1;
Oracle Agile PLM, versiones 9.3.3, 9.3.4, 9.3.5, 9.3.6;
Oracle Application Testing Suite, versiones 13.1, 13.2, 13.3;
Oracle Banking Platform, versiones 2.4.0 - 2.7.1;
Oracle Berkeley DB, versiones 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 12.1.6.2.23, 12.1.6.2.32;
Oracle BI Publisher, versión 11.1.1.9.0;
Oracle Business Intelligence Enterprise Edition, versiones 11.1.1.9.0, 12.2.1.4.0;
Oracle Clusterware, versión 12.1.0.2.0;
Oracle Communications Application Session Controller, versiones 3.7.1, 3.8.0;
Oracle Communications Billing y Revenue Management, versiones 7.5, 12.0;
Oracle Communications Converged Application Server, versiones 5.1, 7.0, 7.1;
Oracle Communications Converged Application Server - Service Controller, versiones 6.0, 6.1;
Oracle Communications Convergence, versión 3.0.2;
Oracle Communications Diameter Signaling Router (DSR), versiones 8.0, 8.1, 8.2, 8.3;
Oracle Communications EAGLE (Software), versiones 46.5, 46.6, 46.7;
Oracle Communications Instant Messaging Server, versión 10.0.1.2.0;
Oracle Communications Interactive Session Recorder, versiones 6.0, 6.1, 6.2;
Oracle Communications Messaging Server, versiones 8.0.2, 8.1.0;
Oracle Communications Online Mediation Controller, versión 6.1;
Oracle Communications Unified, versión 8.0.0.2.0;
Oracle Data Integrator, versión 12.2.1.3.0;
Oracle Database Server, versiones 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c;
Oracle Demantra Demy Management, versión 7.3.1.5.2;
Oracle E-Business Suite, versiones 12.1.1 - 12.1.3, 12.2.3 - 12.2.8;
Oracle Endeca Information Discovery Integrator, versión 3.2.0;
Oracle Endeca Server, versión 7.7.0;
Oracle Enterprise Manager Base Platform, versiones 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0;
Oracle Enterprise Repository, versión 12.1.3.0.0;
Oracle Financial Services - Regulatory Reporting para Reserve Bank of India - Lombard Risk Integration Pack, versión 8.0.7;
Oracle Financial Services - Regulatory Reporting para US Federal Reserve - Lombard Risk Integration Pack, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Analytical Applications Infrastructure, versiones 7.3.3 - 7.3.5, 8.0.2 - 8.0.8;
Oracle Financial Services Analytical Applications Reconciliation Framework, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Asset Liability Management, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Basel Regulatory Capital Basic, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Data Foundation, versiones 8.0.4 - 8.0.8;
Oracle Financial Services Data Integration Hub, versiones 8.0.5 - 8.0.7;
Oracle Financial Services Funds Transfer Pricing, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Hedge Management y IFRS Valuations, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Institutional Performance Analytics, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Liquidity Risk Management, versiones 8.0.1, 8.0.2, 8.0.4, 8.0.5, 8.0.6;
Oracle Financial Services Liquidity Risk Measurement y Management, versiones 8.0.7, 8.0.8;
Oracle Financial Services Loan Loss Forecasting y Provisioning, versiones 8.0.2 - 8.0.7;
Oracle Financial Services Market Risk Measurement y Management, versiones 8.0.5, 8.0.6, 8.0.8;
Oracle Financial Services Price Creation y Discovery, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Profitability Management, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Regulatory Reporting para European Banking Authority, versiones 8.0.6, 8.0.7;
Oracle Financial Services Regulatory Reporting para European Banking Authority - Integration Pack para Lombard Risk, versiones 8.0.6, 8.0.7;
Oracle Financial Services Regulatory Reporting para US Federal Reserve, versiones 8.0.4 - 8.0.7;
Oracle Financial Services Retail Customer Analytics, versiones 8.0.4 - 8.0.6;
Oracle Financial Services Revenue Management y Billing, versiones 2.4.0.0, 2.4.0.1;
Oracle FLEXCUBE Core Banking, versiones 5.2.0, 11.6.0, 11.7.0, 11.8.0;
Oracle FLEXCUBE Enterprise Limits y Collateral Management, versiones 12.0, 12.1;
Oracle FLEXCUBE Investor Servicing, versiones 12.0.1, 12.0.3, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0;
Oracle FLEXCUBE Private Banking, versiones 12.0.1, 12.0.3, 12.1.0;
Oracle FLEXCUBE Universal Banking, versiones 12.0.1 - 12.0.3, 12.1.0 - 12.4.0, 14.0.0 - 14.2.0;
Oracle Global Lifecycle Management OPatchAuto, versiones anteriores a 12.2.0.1.14;
Oracle GraalVM Enterprise Edition, versión 19.0.0;
Oracle Hospitality Gift y Loyalty, versiones 9.0.0, 9.1.0;
Oracle Hospitality Guest Access, versiones 4.2, 4.2.1;
Oracle Hospitality Simphony, versión 18.2.1;
Oracle Hospitality Suite8, versiones 8.9.6, 8.10.2, 8.11 - 8.14;
Oracle HTTP Server, versiones 12.1.3.0.0, 12.2.1.3.0;
Oracle Hyperion Planning, versión 11.1.2.4;
Oracle Hyperion Workspace, versión 11.1.2.4;
Oracle Identity Manager, versiones 11.1.2.3.0, 12.2.1.3.0;
Oracle Insurance Allocation Manager para Enterprise Profitability, versión 8.0.8;
Oracle Insurance Calculation Engine, versiones 9.7, 10.0, 10.1, 10.2;
Oracle Insurance Data Foundation, versiones 8.0.4 - 8.0.7;
Oracle Insurance IFRS 17 Analyzer, versiones 8.0.6, 8.0.7;
Oracle Insurance Performance Insight, versión 8.0.7;
Oracle Insurance Policy Administration J2EE, versiones 10.0, 10.1, 10.2, 11.0;
Oracle Insurance Rules Palette, versiones 10.0, 10.1, 10.2, 11.0;
Oracle Java SE, versiones 7u221, 8u212, 11.0.3, 12.0.1;
Oracle Java SE Embedded, versión 8u211;
Oracle Outside In Technology, versión 8.5.4;
Oracle Retail Advanced Inventory Planning, versión 15.0;
Oracle Retail Customer Management y Segmentation Foundation, versiones 16.0, 17.0, 18.0;
Oracle Retail Financial Integration, versiones 14.0, 14.1, 15.0, 16.0;
Oracle Retail Integration Bus, versiones 15.0, 16.0;
Oracle Retail Order Broker, versiones 5.2, 15.0;
Oracle Retail Order Management System, versión 5.0;
Oracle Retail Predictive Application Server, versiones 14.0.3.26, 14.1.3.37, 15.0.3.100, 16.0;
Oracle Retail Service Backbone, versión 16.0.1;
Oracle Retail Xstore Office, versiones 7.0, 7.1;
Oracle Retail Xstore Point of Service, versiones 7.0, 7.1, 15.0, 16.0, 17.0, 18.0;
Oracle Security Service, versiones 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0;
Oracle SOA Suite, versión 12.2.1.3.0;
Oracle Solaris, versiones 10, 11.3, 11.4;
Oracle Transportation Management, versión 6.3.7;
Oracle Utilities Advanced Spatial y Operational Analytics, versión 2.7.0.1;
Oracle Utilities Framework, versiones 4.3.0.2.0 - 4.3.0.6.0, 4.4.0.0.0;
Oracle VM VirtualBox, versiones anteriores a 5.2.32, anterior a 6.0.10;
Oracle WebCenter Sites, versión 12.2.1.3.0;
Oracle WebLogic Server, versiones 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0;
PeopleSoft Enterprise FIN Project Costing, versión 9.2;
PeopleSoft Enterprise PeopleTools, versiones 8.55, 8.56, 8.57;
PeopleSoft Enterprise PT PeopleTools, versiones 8.55, 8.56, 8.57;
Primavera Analytics, versión 18.8;
Primavera Gateway, versiones 15.2, 16.2, 17.12, 18.8;
Primavera Unifier, versiones 16.1, 16.2, 17.7 - 17.12, 18.8;
Services Tools Bundle, versión 19.2;
Siebel Applications, versiones 19.0 y anteriores;
StorageTek Tape Analytics SW Tool, versión 2.3.0;
Sun ZFS Storage Appliance Kit (AK), versión 8.8.3;
System Utilities, versión 19.1;
Tape Virtual Storage Manager GUI, versión 6.2.

Más informcación en el siguiente enlace.

Referencias:

None

Solución:

Aplicar los parches publicados por Oracle para los productos afectados. Pueden obtenerse del boletín de seguridad

Notas:

Oracle Critical Patch Update Advisory - July 2019

Fuente: Incibe-cert

CSIRT-CV