Recently, NSFOCUS CERT found that Oracle officially released a Critical Patch Update announcement (CPU) in January. A total of 413 vulnerabilities of different levels were fixed this time. This security update involves Oracle WebLogic Server, Oracle MySQL, Oracle Java SE, Oracle Fusion Middleware, Oracle HTTP Server and other commonly used products. Oracle strongly recommends that customers apply critical patch updates to fix the vulnerability as soon as possible.

Screen out the vulnerabilities with great impact in this update according to product popularity and vulnerability importance.

A security feature bypass vulnerability exists in Oracle WebLogic Server. A remote unauthenticated attacker can compromise system integrity through this vulnerability. .

Oracle WebLogic Server has an information disclosure vulnerability. An unauthenticated attacker sends a special request to the affected server through T3/IIOP protocol, which may realize illegal access to critical data or full access to all data of Oracle WebLogic Server, resulting in sensitive information disclosure.

A security feature exists in Oracle WebLogic Server that bypasses a vulnerability by which remote unauthenticated attackers can compromise system integrity or disclose sensitive information after inducing victim interaction.

This security update fixes 40 vulnerabilities for Oracle MySQL, 12 of which can be exploited remotely without user authentication (i.e., through the network without user credentials). High-risk vulnerabilities are numbered as follows:

This security update fixes 71 vulnerabilities for Oracle Financial Services Applications. Fifty-four of these vulnerabilities were remotely exploitable without user authentication. High-risk vulnerabilities are numbered as follows:

The vulnerabilities in the key patch update of Oracle official website in January are summarized as follows:

Please refer to the Appendix “Affected Products and Patch Information” in this document to download the affected product update patch in time, and install and update it by referring to the readme file in the patch installation package to ensure long-term effective protection.

Note: The official patch of Oracle requires the user to have a licensed account of genuine software. After logging in https://support.oracle.com with this account, you can download the latest patch.

1. Restrict T3 protocol access

The following measures can be used to block attacks that exploit T3 protocol vulnerabilities if the user is temporarily unable to install patches or communicate with the JVM via the T3 protocol:

WebLogic Server provides a default connection filter named weblogic.security.net.ConnectionFilterImpl, which accepts all incoming connections. Access control can be performed on T3 and T3s protocols through the configuration rules of this connection filter. The detailed operation steps are as follows:

1) Go to the WebLogic console. On the configuration page of base_domain, go to the Security tab page and click Filters to configure connection filters.

2) Enter weblogic.security.net.ConnectionFilterImpl in the connection filter, and configure rules conforming to the actual situation of the enterprise in the connection filter rule by referring to the following writing:

3) If the rule does not take effect after saving, it is recommended to restart the WebLogic service (restarting the WebLogic service will cause business interruption. It is recommended that relevant personnel assess the risk before proceeding). Taking the Windows environment as an example, the steps to restart the service are as follows: Enter the bin directory under the directory where the domain is located, run stopWebLogic.cmd file in Windows system to terminate WebLogic service, and run stopWebLogic.sh file in Linux system.

After the termination script is executed, run the startWebLogic.cmd or startWebLogic.sh file to start WebLogic to restart the WebLogic service.

2. Disable IIOP protocol

Users can block attacks that exploit IIOP protocol vulnerabilities by disabling the IIOP protocol as follows: In the WebLogic console, choose Services > AdminServer > Protocol and uncheck Enable IIOP. Restart the WebLogic project to make the configuration take effect.

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.