Oracle January 2020 Critical Patch Update Contains 255 CVEs

Oracle rings in the new year with its first Critical Patch Update of 2020 addressing 255 CVEs across 334 security patches, including critical vulnerabilities in Oracle WebLogic Server.

Background

On January 14, Oracle released its Critical Patch Update (CPU) for January 2020 as part of its quarterly release of security patches. This update contains fixes for 255 CVEs in 334 patches across multiple Oracle products. The following is the full list of product families with vulnerabilities addressed in this month’s release:

• Oracle Database Server
• Oracle Communications Applications
• Oracle Construction and Engineering
• Oracle E-Business Suite
• Oracle Enterprise Manager
• Oracle Financial Services Applications
• Oracle Food and Beverage Applications
• Oracle Fusion Middleware
• Oracle GraalVM
• Oracle Health Sciences Applications
• Oracle Hospitality Applications
• Oracle Hyperion
• Oracle iLearning
• Oracle Java SE
• Oracle JD Edwards
• Oracle MySQL
• Oracle PeopleSoft
• Oracle Retail Applications
• Oracle Siebel CRM
• Oracle Systems
• Oracle Supply Chain
• Oracle Utilities Applications
• Oracle Virtualization

Analysis

This quarter’s CPU included 43 critical vulnerabilities across 25 unique CVEs, 41 of which can be remotely exploited without authentication. The most widely patched product families include Oracle Enterprise Manager (50 patches), Oracle Fusion Middleware (38 patches), Oracle Communications Applications (25 patches), Oracle E-Business Suite (23 patches) and Oracle MySQL (19 patches). Here we describe in more detail some of the critically scored CVEs.

Oracle E-Business Suite | CVE-2020-2586, CVE-2020-2587

CVE-2020-2586 and CVE-2020-2587 were the highest-scoring CVEs in Oracle’s January 2020 CPU, with an Oracle assigned CVSSv3 base score of 9.9. These unspecified vulnerabilities in the Hierarchy Diagrammers component of Oracle Human Resources have been described by Oracle as “easily exploitable.” The vulnerabilities allow attackers with network access via HTTPS and low-level privileges to compromise Oracle Human Resources with successful attacks resulting in the unauthorized access, creation, deletion and modification of Oracle Human Resources accessible data. Access to this data may also allow an attacker to cause a partial denial-of-service (DoS). Versions of Oracle Human Resources affected are 12.1.1–12.1.3 and 12.2.3–12.2.9.

Oracle Fusion Middleware | CVE-2020-2555, CVE-2020-2551, CVE-2020-2546

CVE-2020-2555 is an unspecified vulnerability described as “easily exploitable” in the Caching, CacheStore, Invocation component of Oracle Coherence that allows an unauthenticated attacker network access via Oracle’s T3 protocol complete takeover of Oracle Coherence.

CVE-2020-2551 and CVE-2020-2546 are unspecified vulnerabilities described as “easily exploitable” in the WLS Core Components (CVE-2020-2551) and Application Container - JavaEE (CVE-2020-2546) components of Oracle WebLogic Server. An unauthenticated attacker with network access via Internet Inter-Orb Protocol (IIOP) can compromise and take over the Oracle WebLogic Server.

Oracle MySQL | CVE-2019-8457

CVE-2019-8457 is a heap out-of-bounds read vulnerability in the SQLite component of Oracle MySQL that could allow an unauthenticated attacker to compromise and take over MySQL Cluster. Versions of Oracle MySQL affected are 7.3.27 and prior, 7.4.25 and prior, 7.5.15 and prior as well as 7.6.12 and prior.

Oracle Retail Applications | CVE-2019-2904, CVE-2016-5019, CVE-2019-12419

CVE-2019-2904 is an unspecified vulnerability affecting a series of Application Development Framework (ADF) components, including the Application Core component in Oracle Retail Assortment Planning, the Dataset component in Oracle Retail Clearance Optimization Engine, the Common Component Integration component in Oracle Retail Markdown Optimization and the Operational Insights component in Oracle Retail Sales Audit. An unauthenticated attacker with network access via HTTP could exploit this vulnerability with crafted HTTP requests resulting in the compromise and takeover of the ADF.

CVE-2016-5019 is a deserialization attack vulnerability in the Dataset and General Application components of Oracle Retail Clearance Optimization Engine. An attacker could submit an untrusted, specially crafted serialized view state string with the potential to inflict DoS or execute arbitrary code on the target upon it being deserialized.

CVE-2019-12419 is a vulnerability in the token access services in the Order Broker Foundation component of Oracle Retail Order Broker that allows for authentication bypass, as it does not validate the authenticated principal of the clientId parameter in the request. If an attacker obtains a victim’s authorization code, they could obtain a valid access token for said victim. According to the CPU advisory, only version 15 of Oracle Retail Order Broker is affected.

Oracle System | CVE-2019-9636, CVE-2019-2729, CVE-2019-2725, CVE-2016-1000031

CVE-2019-9636 is a vulnerability caused by the improper handling of Unicode encoding (with an incorrect netloc) during Normalization Form Canonical Composition (NFKC) normalization in the Operating System Image component of Sun ZFS Storage Application Kit. An attacker could pass a specially crafted URL that could be incorrectly parsed, potentially disclosing information such as cookies, credentials and authentication data, which could then be passed to a different host when parsed correctly. Only version 8.8.6 of the Sun ZFS Storage Application Kit is affected, according to the January 2020 CPU Advisory.

CVE-2019-2729 and CVE-2019-2725 are unspecified vulnerabilities in the WebLogic Server component of Tape Library Automated Cartridge System Library Software (ACSLS) highlighted as “easily exploitable.” An unauthenticated attacker could exploit this vulnerability requiring only network access via HTTP to compromise and take over the server. Only version 8.5 of the Sun ZFS Storage Application Kit is affected, according to the January 2020 CPU Advisory.

CVE-2016-1000031 is a remote code execution vulnerability found in Apache Commons FileUpload library in the Software component of Tape Library ACSLS. This vulnerability, which has historically been patched for other Oracle products, is easily exploitable, allowing an attacker to compromise the Tape Library ACSLS using HTTP requests.

Solution

Customers are advised to apply all relevant patches provided by Oracle in this CPU. Please refer to the January 2020 advisory for full details.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

• Oracle Critical Patch Update Advisory - January 2020
• Oracle Advisory to CVE Map
• January 2020 CPU Risk Matrix Page

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.