Tenable ブログ
ブログ通知を受信する
オラクル、1月のCritical Patch Updateにより、約300の脆弱性を修正
オラクルは、2019年の初のCritical Patch Updateで約300の脆弱性を修正しました
背景
1月15日、オラクルは四半期ごとの脆弱性修正プログラム「Critical Patch Update」をリリースしました。今月の更新プログラムには、多数のオラクル製品にわたる約300の修正が含まれています。
分析
2019年1月のCritical Patch Update は様々な脆弱性に対処します。これには、libsshの脆弱性 (CVE-2018-10933)に対処するためのMySQL Workbenchの修正を含む、MySQLの30の修正が含まれています。また、Apache Log4jのシリアル化解除の脆弱性（CVE-2017-5645）、およびTenable Researchによって発見されたApache Commons FileUploadのリモートコード実行の脆弱性であるCVE-2016-1000031などのいくつかの修正も含まれています。
以下は、今月のリリースで修正された脆弱性を含む製品の全リストです。
- Oracle Database Server
- Oracle Communications Applications
- Oracle Construction and Engineering Suite
- Oracle E-Business Suite
- Oracle Enterprise Manager Products Suite
- Oracle Financial Services Applications
- Oracle Food and Beverage Applications
- Oracle Fusion Middleware
- Oracle Health Sciences Applications
- Oracle Hospitality Applications
- Oracle Hyperion
- Oracle Insurance Applications
- Oracle Java SE
- Oracle JD Edwards Products
- Oracle MySQL
- Oracle PeopleSoft Products
- Oracle Retail Applications
- Oracle Siebel CRM
- Oracle Sun Systems Products Suite
- Oracle Supply Chain Products Suite
- Oracle Support Tools
- Oracle Utilities Applications
- Oracle Virtualization
ソリューション
このCritical Patch Updateで、オラクル社により提供されたすべての関連するパッチを適用することをお勧めします。
影響を受けているシステムの特定
これらの脆弱性を識別するためのNessusプラグインのリストは、リリースされるたびにこちらに表示されます。
Update January 17: Tenable.io Container Security offers coverage for Oracle Java, Oracle MySQL, Oracle WebLogic and Oracle RDBMS.
詳細情報
- Oracle Critical Patch Update - 2019年1月
- libssh認証バイパスの脆弱性（CVE-2018-10933）
- Apache Commons FileUpload（CVE-2016-1000031）に対するTenable Researchアドバイザリー
最新のアタックサーフェスを総合的に管理する初のサイバーエクスポージャープラットフォーム、 Tenable.io の詳細情報をご覧ください。今すぐ Tenable.io Vulnerability Management の60日間無料トライアルをお試しください。
関連記事
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
- Vulnerability Management