Oracle Security Alert for CVE-2011-5035

Update

Products such as Oracle Audit Vault, Oracle Database, Oracle Enterprise Manager Grid Control and Oracle Identity Management include Oracle Containers for J2EE (OC4J). OC4J is affected by CVE-2011-5035, so security patches need to be applied to OC4J instances in these products. Please refer to Patch Availability Document (My Oracle Support Note 1400322.1) for information on downloading and applying these patches.

Products such as AquaLogic Data Services Platform, AquaLogic Interaction Logging Utilities, Oracle Communications Converged Application Server, Oracle Data Service Integrator, Oracle Enterprise Manager Base Platform, Oracle Enterprise Repository, Oracle Secure Enterprise Search, Oracle Service Bus, WebCenter Interaction, WebLogic Integration, WebLogic Portal, WebLogic SIP Server, WebLogic Workshop include WebLogic Server. WebLogic Server is also affected by CVE-2011-5035, so security patches need to be applied to WebLogic Server instances in these products. Please refer to Patch Availability Document (My Oracle Support Note 1400322.1) for information on downloading and applying these patches.

Description

This security alert addresses the security issue CVE-2011-5035, a denial of service vulnerability in Oracle WebLogic Server, Oracle Application Server (component: Oracle Container for J2EE/OC4J) and Oracle iPlanet Web Server due to hashing collisions. This vulnerability may be remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to affect the system availability.

Affected Products, Versions and Patch Availability

Security Alert patches are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy. We recommend that customers plan product upgrades to ensure that Security Alert patches are available for the versions they are currently running.

Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Security Alert. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities.

The list of affected product releases and versions that are in Premier Support or Extended Support, under the Oracle Lifetime Support Policy is as follows:

For each administered Oracle product, consult the documentation for patch availability information and installation instructions referenced from the table above.

Please note that the fix for the same vulnerability in Oracle GlassFish server was released in January 2012, Oracle Critical Patch Update.

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Security Alert fixes as soon as possible.

References

• Oracle Critical Patch Updates and Security Alerts main page  [ Oracle Technology Network ]
• Oracle Security Alert CVE-2011-5035 Patch Availability Document for Fusion Middleware Suite   [ My Oracle Support Note 1400322.1 ]
• Oracle Security Alert CVE-2011-5035 Patch Availability Document for Sun Products Suite   [ My Oracle Support Note 1400369.1 ]
• Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]  
• Risk Matrix definitions   [ Risk Matrix Definitions ]
• Use of Common Vulnerability Scoring System (CVSS) by Oracle   [ Oracle CVSS Scoring ]
• English text version of the risk matrix   [ Oracle Technology Network ]
• List of public vulnerabilities fixed in Critical Patch Updates and Security Alerts   [ Oracle Technology Network ]
• Software Error Correction Support Policy   [ My Oracle Support Note 209768.1 ]

Modification History

Appendix - Oracle Fusion Middleware

 

Oracle Fusion Middleware Executive Summary

This Security Alert contains 2 new security fixes for Oracle Fusion Middleware. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

Oracle Fusion Middleware Risk Matrix

 

Appendix - Oracle Sun Products Suite

Oracle Sun Products Suite Executive Summary

This Security Alert contains 1 new security fix for the Oracle Sun Products Suite. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

Oracle Sun Products Suite Risk Matrix