ALERT: Update Oracle Database for critical vulnerability
8/14/18 Update: Version 18 of Oracle Database is also affected by this vulnerability. If you are running version 18 on any operating system and have not yet applied the July 2018 CPU, do so now; that CPU addresses the vulnerability.
8/13/18: The information below was sent to U-M IT staff groups via email on August 13, 2018. It is intended for U-M IT staff who are responsible for university servers (on premise or in the cloud) running Oracle Database.
A critical vulnerability has been discovered in Oracle Database that could allow for complete compromise of the database, as well as shell access to the underlying server. Successful exploitation of this vulnerability could allow a remote, authenticated attacker to take complete control of the product and establish shell access to the underlying server.
The Oracle Java Virtual Machine (JVM) component of Oracle Database has a critical vulnerability that allows an authenticated user to access the entire Oracle database and gain shell-level access to the underlying server.
- Oracle Database versions 126.96.36.199, 188.8.131.52, 184.108.40.206 on Windows
- Oracle Database versions 220.127.116.11 on Unix or Linux
Update Oracle Database or disable Oracle JVM as soon as possible. We recommend you do both if possible and appropriate for your environment.
- Update Oracle Database on Windows, Unix, or Linux to the latest version provided by Oracle immediately after appropriate testing. See Oracle Security Alert Advisory - CVE-2018-3110 for details.
- Versions 18.104.22.168 and 22.214.171.124 on Windows. Apply the patches provided by Oracle.
- Version 126.96.36.199 on Windows or any version of the database on Linux or Unix. If you have not yet applied the July 2018 CPU, do so now; that CPU addresses the vulnerability.
- Disable the Oracle JVM if it is not required in your environment. Disabling it will mitigate the attack vector for this vulnerability, and the Oracle JVM is not required in many environments.
In addition, Oracle recommends that those running Oracle Database enforce password complexity (see NIST Special Publication 800-63B, Appendix A).
There are currently no reports of this vulnerability being exploited in the wild, but Oracle strongly recommends that customers take action without delay. The complexity of exploitation is low.
The vulnerability resides in the Java Virtual Machine component of the Oracle Database Server and does not require user interaction. It allows low-privileged attackers that have Create Session privilege with network access via Oracle Net to compromise the Java VM component. The successful exploitation of this vulnerability could allow a remote, authenticated attacker to take complete control of the product and establish shell access to the underlying server. The vulnerability is easy to exploit but cannot be exploited remotely unless the attacker is authenticated.
How We Protect U-M
In addition to notifying U-M IT staff through this notice and outreach to other stakeholders:
- Information Assurance is scanning campus networks for vulnerable hosts so we can work directly with the owners of those hosts to ensure they are patched.
- Information and Technology Services (ITS) Database Administration has already begun to apply the Oracle patches and disable Oracle JVM where it is not necessary.
Information for Users
Oracle Database is typically installed and maintained by IT staff. General computer users do not need to do anything to address this vulnerability.
- Oracle Security Alert Advisory - CVE-2018-3110 (Oracle)
- Oracle Critical Patch Update Advisory - July 2018 (Oracle)
- A Vulnerability in Oracle Database Could Allow for Complete Compromise (Center for Internet Security, 8/13/18)
- Critical vulnerability in Oracle Database, patch without delay! (Help Net Security, 8/13/18)
- Critical Vulnerability Patched in Oracle Database (Security Week, 8/13/18)