Pierluigi Paganini July 22, 2016

18 out of 276 vulnerabilities fixed by Oracle with the last Patch Update resides in the OIT libraries that are used by products of numerous major vendors.

The last critical Patch Update released by Oracle this week is in the headlines for the number of patches it includes. It includes the fixes for 276 vulnerabilities, 19 of them that have been rated critical could expose the products of multiple vendors to cyber attacks.

The security vulnerabilities were reported by researchers at Cisco Talos.

17 high severity flaws affect the Oracle Outside In Technology (OIT) that is a Fusion Middleware suite of software development kits (SDKs) that can decode over 500 different file formats.

Security experts believe that the flaws could have a serious impact also on several third-party applications that use  the OIT libraries, including products Avira, HPE, IBM, Google, Microsoft, Novell, Raytheon, and Symantec.

The experts from Cisco are not able to confirm which third-party products leveraging on the OIT libraries  are vulnerable to cyber attacks, but for sure some of them are impacted.

Researchers reported some attack scenarios easy to exploit by attackers, for example, Exchange 2013 and earlier could be hacked by sending a malicious email attachment to the targeted user. The unique precondition is that the WebReady Document Viewing feature is enabled in Microsoft Exchange 2013 and earlier, an attacker can exploit the vulnerabilities simply by sending a malicious email attachment to the targeted user.

In the case of the Avira AntiVir for Exchange, the popular AV solution automatically scans all inbound and outbound email, this means that an attacker can trigger the vulnerability by sending or receiving a specifically-crafted message.

In January, the US-CERT published a security advisory warning about the presence of multiple stack buffer overflows in the Oracle Outside In 8.5.2. The advisory focused on the flaws in the parsers for WK4, Doc and Paradox DB files. CERT/CC reported at the time that the flaws had affected products from most of the vendors that leveraged the Oracle SDKs.

In that case, the CERT confirmed that the OIT libraries are used by a variety of applications, including Microsoft Exchange, Google Search Appliance, Oracle Fusion Middleware, Guidance Encase Forensics, AccessData FTK, and Novell Groupwise.

Experts from CISCO Talos highlighted that the vendors could take time to test and update their products that use the OIT libraries, in this scenario hackers could try to exploit the flaws in third-party products.

“However, the unfortunate reality is that vulnerabilities that are found in an SDK that is utilized by third-parties will take additional time to patch: First the organization that maintains the SDK issues a fix, and some amount of time later, third-parties that utilize the SDK provide an update to their customers including these fixes. This provides a rather large window of time in which miscreants can exploit vulnerabilities in third-party products. ” reads the analysis published by Cisco Talos.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – hacking, OIT libraries)