security risk notification of high-risk vulnerabilities of multiple Oracle products-Hangzhou pldsec Network Technology Co

0x01 Vulnerability overview

Recently, Oracle officially released the security update in January 2021 and released 329 vulnerability patches, including 60 vulnerability patch updates for Oracle Fusion Middleware, mainly covering

Oracle Weblogic

Oracle Endeca Information Discovery Integrator

Oracle WebCenter Portal

Oracle BI Publisher

Oracle Business Intelligence Enterprise Edition

And other products, 47 of the 60 vulnerability patches can be exploited remotely without authentication.

0x01 Vulnerability description

Oracle WebLogic Server

Weblogic has updated several deserialization vulnerabilities this time, which allow unauthenticated attackers to send constructed malicious requests through HTTP, IIOP and T3 protocols to execute code. Critical vulnerability number is as follows:

CVE-2021-1994

CVE-2021-2047

CVE-2021-2064

CVE-2021-2108

CVE-2021-2075

CVE-2019-17195

Oracle Communications

12 new security patches, of which 7 vulnerabilities can be exploited remotely without authentication, that is, they can be exploited through the network without user credentials. Critical vulnerability number is as follows:

CVE-2019-7164

CVE-2020-24750

Oracle E-Business Suite

31 new security patches, 29 of which can be exploited remotely without authentication, that is, these vulnerabilities can be exploited through the network without user credentials. Critical vulnerability number is as follows:

CVE-2021-2029

CVE-2021-2100

CVE-2021-2101

Oracle Enterprise Manager

8 new security patches, all vulnerabilities can be exploited remotely without authentication, that is, they can be exploited through the network without user credentials. Critical vulnerability number is as follows:

CVE-2019-13990

CVE-2020-11973

CVE-2016-1000031

CVE-2020-11984

CVE-2020-10683

Oracle Financial Services Applications

50 new security patches, of which 41 vulnerabilities can be exploited remotely without authentication, that is, these vulnerabilities can be exploited through the network without user credentials. Critical vulnerability number is as follows:

CVE-2020-11612

CVE-2019-10744

CVE-2020-8174

CVE-2019-3773

CVE-2019-0230

CVE-2020-1945

Oracle Retail Applications

32 new security patches, 20 of which can be exploited remotely without authentication, that is, these vulnerabilities can be exploited through the network without user credentials. Critical vulnerability number is as follows:

CVE-2020-10683

CVE-2020-9546

CVE-2020-9546

CVE-2020-1945

CVE-2020-5421

CVE-2017-8028

Oracle Database Server

8 new security patches. One of these vulnerabilities can be exploited remotely without authentication, that is, these vulnerabilities can be exploited through the network without user credentials. Critical vulnerability number is as follows:

CVE-2021-2035

CVE-2021-2018

0x02 detail link

https://www.oracle.com/security-alerts/cpujan2021.html

0x03 repair suggestions

At present, the official vulnerability repair version has been released. It is recommended that users upgrade to the secure version:

The official Oracle patch needs to be downloaded after logging in to your account.

Security research

Oracle WebLogic Server

Weblogic has updated several deserialization vulnerabilities this time, which allow unauthenticated attackers to send constructed malicious requests through HTTP, IIOP and T3 protocols to execute code. Critical vulnerability number is as follows: