Impatto Sistemico

Alto (66.53)

Sintesi

Oracle ha rilasciato il Critical Patch Update di ottobre che mira a correggere numerose vulnerabilità su più prodotti, di cui 64 con gravità “critica” e 383 con gravità “alta”.

Tipologia

• Privilege Escalation
• Authentication Bypass
• Denial of Service
• Spoofing
• Security Restrictions Bypass
• Information Disclosure

Prodotti e/o versioni affette

Oracle

• Capacity
• PeopleSoft Enterprise PeopleTools
• Siebel CRM Cloud Applications
• Siebel CRM Development
• Siebel Life Sciences
• Autonomous Health Framework
• Siebel Apps – Life Sciences
• Siebel CRM Deployment
• Siebel CRM End User
• EDI Gateway
• Product Lifecycle Analytics
• Agile Product Lifecycle Management for Process
• Secure Backup
• REST Data Services
• Trusted Answer Search
• WebCenter Sites
• Siebel CRM Integration
• Enterprise Manager Base Platform
• Global Lifecycle Management NextGen OUI Framework
• APEX
• Enterprise Manager for Siebel
• Enterprise Manager for Database
• Business Intelligence Enterprise Edition
• Sales Foundation
• Cost Management
• Solaris
• Payroll
• Inventory Management
• Materials Requirement Planning
• Application Testing Suite
• Applications Manager
• Application Object Library
• Purchasing
• Commerce Platform
• Agile PLM
• Helidon
• VM VirtualBox
• Communications Unified Inventory Management
• Mobile Field Service
• Applications DBA
• Marketing
• Report Manager
• Sales Online
• iSetup
• Partner Management
• Call Center Technology
• Concurrent Processing
• MySQL Server
• Communications Billing and Revenue Management
• E-Business Suite Integrated SOA Gateway
• One-to-One Fulfillment
• Pasta
• Common Applications
• Primavera Unifier
• Agile Engineering Data Management
• Communications BRM – Elastic Charging Engine
• MySQL Connectors
• MySQL Cluster
• MySQL Router
• Product Workbench
• Workflow
• Engineering
• Assets
• Product Hub
• General Ledger
• Bills of Material
• Document Management and Collaboration
• HCM Common Architecture
• Mobile Application Server
• Project Contracts
• Quality
• Shipping Execution
• Contract Lifecycle Management for Public Sector
• Global Order Promising
• Strategic Network Optimization
• Installed Base
• Sourcing
• Weblogic Server Proxy Plug-in
• Data Integrator
• WebLogic Server
• Identity Manager
• Access Manager
• Outside In Technology
• JD Edwards EnterpriseOne Tools
• HTTP Server
• GoldenGate
• Applications Platform Engineering
• Order Capture
• Service Bus
• Applications Framework
• Identity Manager Connector
• Business Process Management Suite
• SOA Suite
• iProcurement
• JD Edwards EnterpriseOne Orchestrator
• iSupport
• Java SE
• Siebel Apps – Field Service
• PeopleSoft Enterprise FIN Common Objects Argentina
• PeopleSoft Enterprise SCM Strategic Sourcing
• WebCenter Content
• Database Server
• Management Pack for GoldenGate
• ZFS Storage Appliance Kit
• OLAP
• BI Publisher
• Essbase

Azioni di mitigazione

In linea con le dichiarazioni del vendor, si consiglia di aggiornare i prodotti all’ultima versione disponibile.

Per approfondimenti sui prodotti interessati e sulle modalità di intervento si consiglia di fare riferimento al bollettino di sicurezza disponibile nella sezione Riferimenti.

Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”, con esclusione delle CVE relative a prodotti e/o componenti di terze parti::