# MA-560.012016: MyCERT Advisory - Oracle Releases Security Bulletin

**Date:** 20 Jan 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-560.012016  
**Advisory ID:** MA-560.012016

---

####
**1.0 Introduction**
Oracle has released its Critical Patch Update for January 2016 to address 248 vulnerabilities across multiple products. Users and administrators are encouraged to review the Oracle January 2016 Critical Patch Update and apply the necessary updates.
**2.0 Impact**
Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.
**3.0 Affected Products**
The affected products of Oracle is as listed in the Table 1:
|  | --- | --- | **Product** | **Affected Versions** | Oracle Database Server | version(s) 11.2.0.4, 12.1.0.1, 12.1.0.2 | Oracle GoldenGate | version(s) 11.2 | Oracle BI Publisher | version(s) 11.1.1.7.0 | Oracle Business Intelligence Enterprise Edition | version(s) 11.1.1.7.0 | Oracle Endeca Server | version(s) 7.3.0.0 | Oracle Fusion Middleware | version(s) 10.1.3.5 | Oracle GlassFish Server | version(s) 3.1.2 | Oracle Identity Federation | version(s) 11.1.1.7 | Oracle Outside In Technology | version(s) 8.5.0 | Oracle Tuxedo | version(s) 12.1.1.0 | Oracle Web Cache | version(s) 11.1.1.7.0 | Oracle WebCenter Sites | version(s) 7.6.2 | Oracle WebLogic Portal | version(s) 10.3.6 | Oracle WebLogic Server | version(s) 10.3.6 | Enterprise Manager Base Platform | version(s) 11.1.0.1 | Enterprise Manager Ops Center | version(s) prior to 12.1.4 | Oracle Application Testing Suite | version(s) 12.4.0.2 | Application Mgmt Pack for E | Business Suite, version(s) 12.1, 12.2 | Oracle E | Business Suite, version(s) 11.5.10.2, 12.1, 12.1.1, 12.1.2, 12.1.3, 12.2, 12.2.3, 12.2.4, 12.2.5 | Oracle Agile Engineering Data Management | version(s) 6.1.2.2 | Oracle Agile PLM | version(s) 9.3.1.1 | Oracle Configurator | version(s) 11.5.10.2 | PeopleSoft Enterprise HCM Global Payroll Switzerland | version(s) 9.1 | PeopleSoft Enterprise PeopleTools | version(s) 8.53 | PeopleSoft Enterprise SCM eProcurement | version(s) 9.1 | PeopleSoft Enterprise SCM Order Management | version(s) 9.1 | PeopleSoft Enterprise SCM Purchasing | version(s) 9.1 | JD Edwards EnterpriseOne Tools | version(s) 9.1 | Oracle iLearning | version(s) 6.0 | Oracle Fusion Applications | version(s) 11.1.2 through 11.1.10 | Oracle Communications Converged Application Server | Service Controller, version(s) 6.1 | Oracle Communications EAGLE LNP Application Processor | version(s) 10.0 | Oracle Communications Online Mediation Controller | version(s) 6.1 | Oracle Communications Service Broker | version(s) 6.0 | Oracle Communications Service Broker Engineered System Edition | version(s) 6.0 | MICROS CWDirect | version(s) 12.5 | Oracle Retail Open Commerce Platform Cloud Service | version(s) 3.5 | Oracle Retail Order Broker Cloud Service | version(s) 4.0 | Oracle Retail Order Management System Cloud Service | version(s) 3.5 | Oracle Retail Point of service | version(s) 13.4, 14.0, 14.1 | Oracle Java SE | version(s) 6u105 | Oracle Java SE Embedded | version(s) 8u65 | Oracle JRockit | version(s) R28.3.8 | Oracle Switch ES1 | 24, version(s) prior to 1.3.1.13 | Solaris | version(s) 10 | Solaris Cluster | version(s) 3.3 | Sun Blade 6000 Ethernet Switched NEM 24P 10GE | version(s) prior to 1.2.2.13 | Sun Network 10GE Switch 72p | version(s) prior to 1.2.2.15 | Oracle Secure Global Desktop | version(s) 4.63 | Oracle VM VirtualBox | version(s) prior to 4.0.36 | MySQL Server | version(s) 5.5.46 and prior |
Table 1: Oracle Affected Product
**4.0 Workaround**
Due to the criticality of applying the new security fixes, Administrators are advised to apply the fixes as soon as possible to correct the problems. However, until the fixes are applied, Administrators may consider the below workarounds to reduce possible successful attacks:
- Restrict network protocols required by an attack
- For attacks that require certain privileges or access to certain packages, remove the privileges or the ability to access the packages from unprivileged users
The above workarounds may break application functionality, so Administrators are strongly recommended to test changes on non-production systems first.
Please take note that the above workarounds are only temporary solution measures. Security fixes must be applied to correct the underlying problem permanently.
**5.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products:
- Please refer Patch Set Update and Critical Patch Update January 2016 Availability Document:
<https://support.oracle.com/rs?type=doc&id=2074802.1>
- For access the documentation for those patches, please see Patch Availability Table below:
<http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#PIN>
- Developers can download the latest release from [http://www.oracle.com](http://www.oracle.com/).
- Users running Java SE with a browser can download the latest release from <http://java.com/en/download/installed.jsp>. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.
- Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly "Oracle Enterprise Manager Grid Control") and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in My Oracle Support Note 209768.1.
<https://support.oracle.com/rs?type=doc&id=209768.1>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#89eaf0ebecfbb0b0b0c9eaf0ebecfbfaeceafcfbe0fdf0a7e4f0) or [[email protected]](/cdn-cgi/l/email-protection#ddb0a4beb8afa99db0a4beb8afa9f3b2afbaf3b0a4) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 References**
- Adobe Releases Security Bulletin:
<https://www.us-cert.gov/ncas/current-activity/2016/01/19/Oracle-Releases-Security-Bulletin>
- Oracle Critical Patch Update Advisory - January 2016:
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htm](http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html)
- Critical Patch Updates, Security Alerts and Third Party Bulletin
<http://www.oracle.com/technetwork/topics/security/alerts-086861.html>