# MA-371.012014: MyCERT Alert - Oracle Critical Patch Update Advisory - January 2014

**Date:** 16 Jan 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-371.012014  
**Advisory ID:** MA-371.012014

---

**1.0 Introduction**
Oracle has released a Critical Patch Update (CPU) for Oracle product families. Customers are strongly recommended to apply CPU fixes as soon as possible.
A CPU is a collection of patches for multiple security vulnerabilities. Multiple critical vulnerabilities have been identified in vulnerabilities across a wide range of product families, including: Oracle Database, Oracle Fusion Middleware, Oracle Hyperion, Oracle E-Business Suite, Oracle Supply Chain Products Suite, Oracle PeopleSoft Enterprise, Oracle Siebel CRM, Oracle FLEXCUBE, Oracle Java SE, Oracle and Sun Systems Products Suite, Oracle Linux and Virtualization, and Oracle MySQL. Collections of patches have been released this month to address these issues.
**2.0 Impact**
This Critical Patch Update provided fixes for 144 new security vulnerabilities across a wide range of product families.
The January 2014 Critical Patch Update provided:
- 5 fixes for the Oracle Database. The maximum CVSS Base Score for these database vulnerabilities was 5.0. This score was for one vulnerability (CVE-2013-5853), which also happened to be the only remotely exploitable without authentication database vulnerability in this Critical Patch Update.
- 22 security fixes for Oracle Fusion Middleware, 19 of which were for vulnerabilities that were remotely exploitable without authentication. The most severe CVSS Base Score for these vulnerabilities is 10.0. This score is for vulnerability CVE-2013-4316 that affects Oracle WebCenter Sites (versions 11.1.1.6.1 and 11.1.1.8.0).
- 2 new security fixes for Oracle Hyperion. One of these vulnerabilities (CVE-2013-3830) received a CVSS Base Score of 7.1, which denotes a complete compromise if successfully exploited, but also requires a single authentication from the attacker.
- a number of fixes for Oracle applications. 4 security fixes are for Oracle E-Business Suite (one of the vulnerabilities may be remotely exploitable without authentication), 16 security fixes are for Oracle Supply Chain Products Suites (6 of the vulnerabilities may be remotely exploitable without authentication), 17 security fixes are for Oracle PeopleSoft Enterprise (10 of the vulnerabilities may be remotely exploitable without authentication). 2 security fixes are for Oracle Siebel CRM (one of the vulnerabilities may be remotely exploitable without authentication), etc.
- 36 security fixes for Java SE. 34 of these Java SE vulnerabilities may be remotely exploitable without authentication. Only 3 of these vulnerabilities are relevant to Java SE or JSSE server deployments, but are not server side specific (that is they also affect client deployments). The maximum CVSS Base Score for Java SE vulnerabilities fixed in this Critical Patch Update is 10.0. This score affects 5 vulnerabilities (one of them being applicable to server deployments, that is, it can be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets).
Due to possible successful attacks, Administrators are strongly recommended to apply the new security fixes as soon as possible because it includes fixes for a number of severe vulnerabilities.
**3.0 Affected Products**
Below is the details list of critical patch update for Oracle product:
- Oracle Database
- Oracle Fusion Middleware
- Oracle Hyperion
- Oracle E-Business Suite
- Oracle Supply Chain Products Suite
- Oracle PeopleSoft Enterprise
- Oracle Siebel CRM
- Oracle FLEXCUBE
- Oracle Java SE
- Oracle and Sun Systems Products Suite
- Oracle Linux and Virtualization
- Oracle MySQL
**4.0 Workaround**
Due to the criticality of applying the new security fixes, Administrators are advised to apply the fixes as soon as possible to correct the problems. However, until the fixes are applied, Administrators may consider the below workarounds to reduce possible successful attacks:
- Restrict network protocols required by an attack
- For attacks that require certain privileges or access to certain packages, remove the privileges or the ability to access the packages from unprivileged users
The above workarounds may break application functionality, so Administrators are strongly recommended to test changes on non-production systems first.
Please take note that the above workarounds are only temporary solution measures. Security fixes must be applied to correct the underlying problem permanently.
**5.0 Recommendation**
Oracle has released a security update for these issues. Users are highly encouraged to download the most recent release to address these vulnerabilities. Update can be obtained from:
- Oracle Critical Patch Update January 2014 Documentation Map, [My Oracle Support Note 1592294.1.](https://support.oracle.com/rs?type=doc&id=1592294.1)
- [Patch Availability Table](http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#PIN) to access the documentation for those patches.
- Developers can download the latest release from <http://www.oracle.com>.
- Users running Java SE with a browser can download the latest release from <http://java.com/en/download/installed.jsp>. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.
- Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly "Oracle Enterprise Manager Grid Control") and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in [My Oracle Support Note 209768.1.](https://support.oracle.com/rs?type=doc&id=209768.1)
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#6a0913080f185353532a0913080f18190f091f18031e13440713) or [[email protected]](/cdn-cgi/l/email-protection#5b3622383e292f1b3622383e292f7534293c753622)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**6.0 References**
- <http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html>
- <http://www.us-cert.gov/ncas/current-activity/2014/01/14/Oracle-Releases-January-2014-Security-Advisory>
- <https://blogs.oracle.com/security/entry/january_2014_critical_patch_update>