Title : Oracle and BEA Products Multiple Code Execution Vulnerabilities
VUPEN ID : VUPEN/ADV-2009-0115
CVE ID : CVE-2008-2623 - CVE-2008-3973 - CVE-2008-3974 - CVE-2008-3978 - CVE-2008-3979 - CVE-2008-3981 - CVE-2008-3997 - CVE-2008-3999 - CVE-2008-4006 - CVE-2008-4007 - CVE-2008-4014 - CVE-2008-4015 - CVE-2008-4016 - CVE-2008-4017 - CVE-2008-5436 - CVE-2008-5437 - CVE-2008-5438 - CVE-2008-5439 - CVE-2008-5440 - CVE-2008-5441 - CVE-2008-5442 - CVE-2008-5443 - CVE-2008-5444 - CVE-2008-5445 - CVE-2008-5446 - CVE-2008-5447 - CVE-2008-5448 - CVE-2008-5449 - CVE-2008-5450 - CVE-2008-5451 - CVE-2008-5452 - CVE-2008-5454 - CVE-2008-5455 - CVE-2008-5456 - CVE-2008-5457 - CVE-2008-5458 - CVE-2008-5459 - CVE-2008-5460 - CVE-2008-5461 - CVE-2008-5462 - CVE-2008-5463
CWE ID : CWE-19 - CWE-20 - CWE-89 - CWE-119 - CWE-200 - CWE-426 - CWE-476
Rated as : Critical 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2009-01-13


세부설명
==========
다양한 Oracle과 BEA 제품들에서 원격, 로컬의 공격자가 서비스 거부를 발생시키거나 특정 데이터를 읽고 조작하거나
중요한 정보 노출, SQL Injection 공격, 제한된 보안 우회, 임의의 명령어 실행등 다양한 취약점이 확인되었다.

이들 문제는 the Job Queue, Oracle OLAP, Oracle Spatial, Oracle Streams, SQL*Plus Windows GUI, TimesTen Data Server, Oracle Secure Backup, OC4J, Oracle BPEL Process Manager, Oracle Portal, Oracle JDeveloper, Collaborative Workspaces, Oracle Application Object Library, iProcurement, Oracle Applications Framework, Oracle Applications Platform Engineering, Oracle Enterprise Manager, PeopleSoft Enterprise Components, PeopleSoft Enterprise HRMS, PeopleSoft Enterprise Campus Solutions, ePerformance, JD Edwards Tools, WebLogic Server Plugins, WebLogic Portal and WebLogic Server 에서 에러가 발생하기 때문이다.


해결책
==========

Apply Oracle Critical Patch Update - January 2009 :
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html


레퍼런스
==========
http://www.vupen.com/english/advisories/2009/0115
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html


영향받는 버전
==========
Oracle Database 11g version 11.1.0.6
Oracle Database 10g Release 2 version 10.2.0.2
Oracle Database 10g Release 2 version 10.2.0.3
Oracle Database 10g Release 2 version 10.2.0.4
Oracle Database 10g version 10.1.0.5
Oracle Database 9i Release 2 version 9.2.0.8
Oracle Database 9i Release 2 version 9.2.0.8DV
Oracle Secure Backup version 10.2.0.2
Oracle Secure Backup version 10.2.0.3
Oracle Secure Backup version 10.1.0.1
Oracle Secure Backup version 10.1.0.2
Oracle Secure Backup version 10.1.0.3
Oracle TimesTen In-Memory Database version 7.0.5.1.0
Oracle TimesTen In-Memory Database version 7.0.5.2.0
Oracle TimesTen In-Memory Database version 7.0.5.3.0
Oracle TimesTen In-Memory Database version 7.0.5.4.0
Oracle Application Server 10g Release 3 (10.1.3) version 10.1.3.3.0
Oracle Application Server 10g Release 2 (10.1.2) version 10.1.2.2.0
Oracle Application Server 10g Release 2 (10.1.2) version 10.1.2.3.0
Oracle Collaboration Suite 10g version 10.1.2
Oracle E-Business Suite Release 12 version 12.0.6
Oracle E-Business Suite Release 11i version 11.5.10.2
Oracle Enterprise Manager Grid Control 10g Release 4 version 10.2.0.4
PeopleSoft Enterprise HRMS version 8.9
PeopleSoft Enterprise HRMS version 9.0
JD Edwards Tools version 8.97
Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 through MP1
Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) 9.1 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) 9.2 through MP3
Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 through SP6
Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 through SP7
Oracle WebLogic Portal (formerly BEA WebLogic Portal) 10.0 through MP1
Oracle WebLogic Portal (formerly BEA WebLogic Portal) 10.2 GA
Oracle WebLogic Portal (formerly BEA WebLogic Portal) 10.3 GA
Oracle WebLogic Portal (formerly BEA WebLogic Portal) 9.2 through MP3
Oracle WebLogic Portal (formerly BEA WebLogic Portal) 8.1 through SP6
와우해커(WOWHACKER) 시누싱입니다.