Oracle Periodically Security Update – Mitigating with ASM

Recently Oracle published its periodically security advisory. The advisory contains fixes for 334 CVEs, 231 of them are exploitable over the HTTP protocol.

Oracle tends not to publicly disclose details related to the attack vectors of the vulnerabilities they publish; however, we could tell based on public information that already exist for some of the vulnerabilities whether we are able to mitigate the attack vector with existing ASM signatures.

BIG-IP ASM customers are already protected against the following vulnerabilities published in the advisory:

CVE Identifier	Product	Signature IDs / Attack Type
CVE-2018-2943	Oracle Fusion Middleware MapViewer	Path Traversal Signatures
CVE-2018-3101	Oracle WebCenter Portal	200018018,200018030,200018036,200018037
CVE-2018-2894	Oracle WebLogic Server	200004048, Java Server Side Code Injection Signatures
CVE-2018-2945	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-2946	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-2947	JD Edwards EnterpriseOne Tools	Path Traversal Signatures
CVE-2018-2948	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-2949	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-2950	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-3100	Oracle Business Process Management Suite	SQL-Injection Signatures
CVE-2018-3105	Oracle SOA Suite	Path Traversal Signatures
CVE-2018-2999	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-3006	JD Edwards EnterpriseOne Tools	Cross Site Scripting (XSS) Signatures
CVE-2018-3016	PeopleSoft Enterprise PeopleTools	Cross Site Scripting (XSS) Signatures
CVE-2018-7489	Oracle WebLogic Server	Java Server Side Code Injection Signatures

We are constantly monitoring newly disclosed information and PoCs containing the attack vectors for the other vulnerabilities not mentioned in the table above and will release ASM signature updates if required.

Published Jul 19, 2018

Version 1.0

ASM Advanced WAF

oracle

security