Oracle January 2020 Critical Patch Update Contains 255 CVEs
Oracle rings in the new year with its first Critical Patch Update of 2020 addressing 255 CVEs across 334 security patches, including critical vulnerabilities in Oracle WebLogic Server.
Background
On January 14, Oracle released its Critical Patch Update (CPU) for January 2020 as part of its quarterly release of security patches. This update contains fixes for 255 CVEs in 334 patches across multiple Oracle products. The following is the full list of product families with vulnerabilities addressed in this month’s release:
- Oracle Database Server
- Oracle Communications Applications
- Oracle Construction and Engineering
- Oracle E-Business Suite
- Oracle Enterprise Manager
- Oracle Financial Services Applications
- Oracle Food and Beverage Applications
- Oracle Fusion Middleware
- Oracle GraalVM
- Oracle Health Sciences Applications
- Oracle Hospitality Applications
- Oracle Hyperion
- Oracle iLearning
- Oracle Java SE
- Oracle JD Edwards
- Oracle MySQL
- Oracle PeopleSoft
- Oracle Retail Applications
- Oracle Siebel CRM
- Oracle Systems
- Oracle Supply Chain
- Oracle Utilities Applications
- Oracle Virtualization
Analysis
This quarter’s CPU included 43 critical vulnerabilities across 25 unique CVEs, 41 of which can be remotely exploited without authentication. The most widely patched product families include Oracle Enterprise Manager (50 patches), Oracle Fusion Middleware (38 patches), Oracle Communications Applications (25 patches), Oracle E-Business Suite (23 patches) and Oracle MySQL (19 patches). Here we describe in more detail some of the critically scored CVEs.
Oracle E-Business Suite | CVE-2020-2586, CVE-2020-2587
CVE-2020-2586 and CVE-2020-2587 were the highest-scoring CVEs in Oracle’s January 2020 CPU, with an Oracle assigned CVSSv3 base score of 9.9. These unspecified vulnerabilities in the Hierarchy Diagrammers component of Oracle Human Resources have been described by Oracle as “easily exploitable.” The vulnerabilities allow attackers with network access via HTTPS and low-level privileges to compromise Oracle Human Resources with successful attacks resulting in the unauthorized access, creation, deletion and modification of Oracle Human Resources accessible data. Access to this data may also allow an attacker to cause a partial denial-of-service (DoS). Versions of Oracle Human Resources affected are 12.1.1–12.1.3 and 12.2.3–12.2.9.
Oracle Fusion Middleware | CVE-2020-2555, CVE-2020-2551, CVE-2020-2546
CVE-2020-2555 is an unspecified vulnerability described as “easily exploitable” in the Caching, CacheStore, Invocation component of Oracle Coherence that allows an unauthenticated attacker network access via Oracle’s T3 protocol complete takeover of Oracle Coherence.
CVE-2020-2551 and CVE-2020-2546 are unspecified vulnerabilities described as “easily exploitable” in the WLS Core Components (CVE-2020-2551) and Application Container - JavaEE (CVE-2020-2546) components of Oracle WebLogic Server. An unauthenticated attacker with network access via Internet Inter-Orb Protocol (IIOP) can compromise and take over the Oracle WebLogic Server.
Oracle MySQL | CVE-2019-8457
CVE-2019-8457 is a heap out-of-bounds read vulnerability in the SQLite component of Oracle MySQL that could allow an unauthenticated attacker to compromise and take over MySQL Cluster. Versions of Oracle MySQL affected are 7.3.27 and prior, 7.4.25 and prior, 7.5.15 and prior as well as 7.6.12 and prior.
Oracle Retail Applications | CVE-2019-2904, CVE-2016-5019, CVE-2019-12419
CVE-2019-2904 is an unspecified vulnerability affecting a series of Application Development Framework (ADF) components, including the Application Core component in Oracle Retail Assortment Planning, the Dataset component in Oracle Retail Clearance Optimization Engine, the Common Component Integration component in Oracle Retail Markdown Optimization and the Operational Insights component in Oracle Retail Sales Audit. An unauthenticated attacker with network access via HTTP could exploit this vulnerability with crafted HTTP requests resulting in the compromise and takeover of the ADF.
CVE-2016-5019 is a deserialization attack vulnerability in the Dataset and General Application components of Oracle Retail Clearance Optimization Engine. An attacker could submit an untrusted, specially crafted serialized view state string with the potential to inflict DoS or execute arbitrary code on the target upon it being deserialized.
CVE-2019-12419 is a vulnerability in the token access services in the Order Broker Foundation component of Oracle Retail Order Broker that allows for authentication bypass, as it does not validate the authenticated principal of the clientId parameter in the request. If an attacker obtains a victim’s authorization code, they could obtain a valid access token for said victim. According to the CPU advisory, only version 15 of Oracle Retail Order Broker is affected.
Oracle System | CVE-2019-9636, CVE-2019-2729, CVE-2019-2725, CVE-2016-1000031
CVE-2019-9636 is a vulnerability caused by the improper handling of Unicode encoding (with an incorrect netloc) during Normalization Form Canonical Composition (NFKC) normalization in the Operating System Image component of Sun ZFS Storage Application Kit. An attacker could pass a specially crafted URL that could be incorrectly parsed, potentially disclosing information such as cookies, credentials and authentication data, which could then be passed to a different host when parsed correctly. Only version 8.8.6 of the Sun ZFS Storage Application Kit is affected, according to the January 2020 CPU Advisory.
CVE-2019-2729 and CVE-2019-2725 are unspecified vulnerabilities in the WebLogic Server component of Tape Library Automated Cartridge System Library Software (ACSLS) highlighted as “easily exploitable.” An unauthenticated attacker could exploit this vulnerability requiring only network access via HTTP to compromise and take over the server. Only version 8.5 of the Sun ZFS Storage Application Kit is affected, according to the January 2020 CPU Advisory.
CVE-2016-1000031 is a remote code execution vulnerability found in Apache Commons FileUpload library in the Software component of Tape Library ACSLS. This vulnerability, which has historically been patched for other Oracle products, is easily exploitable, allowing an attacker to compromise the Tape Library ACSLS using HTTP requests.
Solution
Customers are advised to apply all relevant patches provided by Oracle in this CPU. Please refer to the January 2020 advisory for full details.
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Get more information
- Oracle Critical Patch Update Advisory - January 2020
- Oracle Advisory to CVE Map
- January 2020 CPU Risk Matrix Page
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Microsoft Patch Tuesday 2024 Year in Review
December 10, 2024Microsoft addressed over 1000 CVEs as part of Patch Tuesday releases in 2024, including 22 zero-day vulnerabilities.
Microsoft’s December 2024 Patch Tuesday Addresses 70 CVEs (CVE-2024-49138)
December 10, 2024Microsoft addresses 70 CVEs with 16 rated critical, including one zero-day that was exploited in the wild.
If You Only Have 1 Minute: Quick Tips for Effective Exposure Response
December 2, 2024Comprehensive, action-oriented workflows and key metrics are the cornerstones of a successful exposure response program. Here’s what you need to know.
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
- Vulnerability Management