Ha valakit érdekel itt a metalinkes:
Security Vulnerability FAQ for Oracle Desktop Virtualization Products (Doc ID 2432034.1)
Applies to:
Oracle Secure Global Desktop
Oracle VM VirtualBox
Information in this document applies to any platform.
Purpose
The purpose of this Q&A Document is to help the customers understand the criteria to be followed during the creation of a security related SR for any of Oracle's Desktop Virtualization products.
Questions and Answers
Critical Patch Updates
I want to protect my Oracle Desktop Virtualization products from known vulnerabilities before going production, what is the first action to take?
Answer:
Apply the latest available patchset for your installation, then the Critical Patch Update (CPU) for your final version. Oracle currently delivers the latest Critical Patch Updates on a quarterly basis: January, April, July, and October of each year. Administrators should continually review and install any referenced updates to secure a deployment.
To obtain Critical Patch Updates, Oracle recommends the following as a starting point:
Critical Patch Updates (CPU) and Security Alerts
https://www.oracle.com/technetwork/topics/security/alerts-086861.html
- Check for latest Security Advisory and a Patch Availability Document for the product installed to obtain patches
- A Security Advisory documents the vulnerabilities for a specific CPU release.
- A Patch Availability Document provides the cumulative patches for each product version within Lifetime Support
Vulnerability Information
There is a potential vulnerability published on the Internet and I need to know if my Desktop Virtualization product has been impacted and how. Where can I obtain information from Oracle on this vulnerability?
Answer:
Oracle does not provide comments regarding published information regarding alleged vulnerabilities in Oracle Products. When Oracle learns about such alleged vulnerabilities, either via periodic scans of such sites or via individuals that have brought such vulnerabilities to Oracle's attention, Oracle will investigate fully and, if warranted, create fixes for upcoming releases, Security Alerts and/or quarterly Critical Patch Updates.
This is in order to protect its customers, and in accordance with the company’s security policies, Oracle does not specifically comment or provide technical information about security vulnerabilities outside of the Critical Patch Update and Security Alert programs.
Note that in many cases external vulnerability reports are materially in error because:
- The impacts are inaccurate
- Access or version information is inaccurate
- There may be no bug or it may not be a security bug
- Proposed workarounds may be ineffective in all or many configurations.
- Proposed workarounds may cause regressions
Oracle recommends that customers get all their security vulnerability information from Oracle Critical Patch Update advisories available from links at:
https://www.oracle.com/technetwork/topics/security/alerts-086861.html
Oracle thanks individuals for calling such vulnerability reports to its attention as it helps Oracle improve its products for all its customers.
Rationale
People ask for many comments regarding externally described vulnerabilities. In many cases, our answers are guided by the principle that "Oracle will not divulge information that might aid an attacker in exploiting an Oracle product". Of course, there are other considerations:
- Many times we cannot confidently identify externally reported vulnerabilities and then, obviously, cannot provide a comment.
- Many times we know reports are inaccurate. If we inform the site that the description, etc. is inaccurate, the site will want us to provide accurate information and such information would often aid an attacker.
- Very few workarounds work in all situations. Providing explanations when workaround will and will not be effective often provides key information to potential attackers.
- If we provide information that externally described vulnerabilities are fixed in particular CPUs, attackers can conclude that other described vulnerabilities are not fixed. This can significantly aid attackers by allowing them to focus their attacks.
- As a general policy Oracle does not respond to questions requesting if or when externally reported vulnerability fixes will be released.
Scan Reports
I have used a security scanning tool from a third-party which has detected a potential vulnerability. I have applied the latest Critical Patch Update, and the scan results are the same. I have confirmed that the recommendations from the vendor are more than a configuration request and suggests the issue needs to be fixed. Where can I obtain information from Oracle on this scanning report?
Answer:
In the case of security scans from a third party, it is unknown if the scan is actually exposing the vulnerability, only checking for an impacted version, or something that is usually present to indicate the vulnerability could be there.
If a Service Request (SR) needs to be created on My Oracle Support, actions for Support should be clearly defined with one SR for each issue providing enough information to reproduce the alleged vulnerability. Oracle Support cannot engage in a third-party scan report consultation.
See Question on creating an SR.
Note these same policies apply to Penetration Testing Organizations.
To protect against any known, fixed and applicable vulnerabilities, apply the latest Critical Patch Update. If you have a new exploit which demonstrates a vulnerability, please provide a testcase which allows Oracle to reproduce the same. If you have a current CVE number, it is a public vulnerability and the filer of such CVE should be working directly with product vendors (such as Oracle). Oracle does review all public vulnerabilities filed with
http://cve.mitre.org and
http://nvd.nist.gov, which may impact Oracle products.
Reporting Security Vulnerabilities
https://www.oracle.com/technetwork/topics/security/alerts-086861.html#ReportingVulnerabilities
Security Vulnerability Fixing Policy and Process
https://www.oracle.com/support/assurance/vulnerability-remediation/security-fixing.html