GovCERT.HK - High Threat Security Alert (A20-10-06): Multiple Vulnerabilities in Oracle Java and Oracle Products (October 2020)

Description:

Oracle has released the Critical Patch Update (CPU) Advisory with collections of patches for multiple security vulnerabilities found in Java SE and various Oracle products. The list of security updates can be found at:

This link will open in a new windowhttps://www.oracle.com/security-alerts/cpuoct2020.html

Oracle has released an out-of-band security update to address another remote code execution vulnerability (CVE-2020-14750) in Oracle WebLogic server. A proof-of-concept (PoC) code exploiting CVE-2020-14750 is publicly available. System administrator are advised to apply the latest security patch on the affected systems immediately to mitigate the elevated risk of cyber attacks.

Reports indicate that active exploitation against a critical vulnerability (CVE-2020-14882) for remote code execution in Oracle WebLogic server have been observed. In view of the elevated risk of cyber attacks, system administrators should accord priority to patch this particular vulnerability immediately.

Before the patch could be applied, system administrators should ensure that the admin portal (TCP port 7001 by default) is not exposed to the Internet and keep blocking access to the admin portal from untrusted network, review application logs for suspicious HTTP requests including double-encoded path traversal ‘%252E%252E%252F’ to admin portal console, and monitor any suspicious processes created by an application.

Affected Systems:

Oracle Java SE
OpenJDK
Database
Oracle Linux and Virtualization
Oracle MySQL Product Suite
Oracle and Sun Systems Products Suite
Fusion Applications and Middleware

A complete list of the affected products can be found at:
This link will open in a new windowhttps://www.oracle.com/security-alerts/cpuoct2020.html

Impact:

Depending on the vulnerability exploited, a successful attack could lead to denial of services, data tampering, information disclosure, system crash or compromise of a vulnerable system.

Recommendation:

Patches for affected systems are available. Users of the affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

For Oracle Java SE products, please refer to the following link:

Java Platform SE 8u271 (JDK and JRE)
Java Platform SE 11.0.9 (JDK and JRE)
Java Platform SE 15.0.1 (JDK and JRE)

This link will open in a new windowhttps://www.oracle.com/java/technologies/javase-downloads.html

For OpenJDK, please refer to the following link:
This link will open in a new windowhttps://jdk.java.net

Users could also access the security advisory below for the information about the security updates of other Oracle products:
This link will open in a new windowhttps://www.oracle.com/security-alerts/cpuoct2020.html

Users may contact their product support vendors for the fixes and assistance.

More Information:

Tag: Oracle , Java , OpenJDK , Oracle Database , Oracle Linux , MySQL , Sun Systems , Fusion