# MA-360.102013: MyCERT Alert - Oracle Java Critical Patch Update Advisory - October 2013

**Date:** 17 Oct 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-360.102013  
**Advisory ID:** MA-360.102013

---

**1.0 Introduction**
Oracle has released a Critical Patch Update (CPU) for Oracle product families. Customers are strongly recommended to apply CPU fixes as soon as possible.
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Multiple critical vulnerabilities have been identified in Oracle's Database, Fusion Middleware, PeopleSoft and the Java Standard Edition platform products. Oracle Java and a collection of patches have been released this month to address these issues.
**2.0 Impact**
This Critical Patch Update contains 127 new security updates for wide variety of Oracle product families. 2 are specifically for Oracle Database. The maximum CVSS Base Score for the database vulnerabilities is 5.5. One of these database vulnerabilities has already been fixed in all supported version and platform combinations. 2 Oracle Fusion Middleware fixes are applicable to database deployments.
51 vulnerabilities fixed are for Java SE. 50 of the Java SE vulnerabilities fixed in this Critical patch Update are remotely exploitable without authentication. The maximum CVSS Base Score for these Java SE vulnerabilities is 10.0. Only 8 are applicable to client and server deployments of Java. 40 apply to client deployment of Java, including one, which is only exploitable during Java client deployment. One of the vulnerabilities applies to the JHat developer tool. The last 2 vulnerabilities apply to sites that run the Javadoc tool as a service.
17 security fixes for Oracle Fusion Middleware, 12 of those vulnerabilities, which are remotely exploitable without authentication. The maximum CVSS Base Score for these Fusion Middleware vulnerabilities is 7.5.
4 new security fixes are for Oracle Enterprise Manager Grid Control. All of these Enterprise Manager Grid Control vulnerabilities are remotely exploitable without authentication, and the maximum CVSS Base Score for these vulnerabilities is 4.3.
22 new security fixes for Oracle applications as follows: 1 for Oracle E-Business Suite, 2 for Oracle Supply Chain Products Suite, 8 for PeopleSoft Enterprise, 9 for Siebel CRM, and 2 for iLearning. It furthermore provides 6 new security fixes for Oracle Industry Applications and 1 for Oracle Financial Services Software.
12 new security fixes for the Oracle and Sun Systems Products Suite. 5 of these vulnerabilities are remotely exploitable without authentication. The maximum CVSS Base Score for these vulnerabilities is 6.9.
Due to possible successful attacks, Administrators are strongly recommended to apply the new security fixes as soon as possible because it includes fixes for a number of severe vulnerabilities.
**3.0 Affected Products**
Oracle Database, Oracle Fusion Middleware, Oracle Enterprise Manager Grid Control, Oracle E-Business Suite, Oracle Supply Chain Products Suite, Oracle PeopleSoft Enterprise, Oracle Siebel CRM, Oracle iLearning, Oracle industry Applications, Oracle FLEXCUBE, Oracle Primavera, Oracle Java SE, Oracle and Sun Systems Products Suite, Oracle Linux and Virtualization, and Oracle MySQL.
**4.0 Workaround**
Due to the criticality of applying the new security fixes, Administrators are advised to apply the fixes as soon as possible to correct the problems. However, until the fixes are applied, Administrators may consider the below workarounds to reduce possible successful attacks:
- Restrict network protocols required by an attack
- For attacks that require certain privileges or access to certain packages, remove the privileges or the ability to access the packages from unprivileged users
The above workarounds may break application functionality, so Administrators are strongly recommended to test changes on non-production systems first.
Please take note that the above workarounds are only temporary solution measures. Security fixes must be applied to correct the underlying problem permanently.
**5.0 Recommendation**
Oracle has released a security update for these issues. Users are highly encouraged to download the most recent release to address these vulnerabilities. Update can be obtained from:
- Oracle Java Critical Patch Update October 2013 [My Oracle Support Note 1571391.1](https://support.oracle.com/rs?type=doc&id=1571391.1).
- Developers can download the latest release from <http://www.oracle.com>.
- Users running Java SE with a browser can download the latest release from <http://java.com/en/download/installed.jsp>. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.
- Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly "Oracle Enterprise Manager Grid Control") and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in [My Oracle Support Note 209768.1](https://support.oracle.com/rs?type=doc&id=209768.1).
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#45263c2720377c7c7c05263c27203736202630372c313c6b283c) or [[email protected]](/cdn-cgi/l/email-protection#7f12061c1a0d0b3f12061c1a0d0b51100d18511206)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**6.0 References**
- <http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html>
- <http://www.v3.co.uk/v3-uk/news/2300941/oracle-issues-51-critical-java-patches-in-giant-security-update>
- <https://blogs.oracle.com/security/entry/october_2013_critical_patch_update>