2018년 4월 Oracle Critical Patch Update 권고
2019.06.10 03:04
□ 개요
o 오라클社 CPU에서 자사 제품의 보안 취약점 254개에 대한 패치를 발표 [1]
※ CPU(Critical Patch Update) : 오라클 중요 보안 업데이트
o 영향 받는 버전의 사용자는 악성코드 감염 등에 취약할 수 있으므로, 아래 해결방안에 따라 최신버전으로 업데이트 권고
□ 영향을 받는 시스템
o Enterprise Manager Base Platform, versions 12.1.0.5, 13.2.0.0
o Enterprise Manager for MySQL Database, version 12.1.0.4
o Enterprise Manager for Virtualization, version 13.2
o Enterprise Manager Ops Center, versions 12.2.2, 12.3.3
o Hardware Management Pack, versions prior to 2.4.3
o Instantis EnterpriseTrack, versions 17.1, 17.2
o Integrated Lights Out Manager (ILOM), versions 3.x, 4.x
o JD Edwards EnterpriseOne Tools, version 9.2.2
o JD Edwards World Security, versions A9.2, A9.3, A9.4
o Management Pack for Oracle GoldenGate, version 11.2.1.0.13
o MICROS Handheld Terminal, versions Prior to Fusion 2.03.0.0.021R
o MICROS Lucas, version 2.9.5
o MySQL Cluster, versions 7.2.27 and prior, 7.3.16 and prior, 7.4.14 and prior, 7.5.5 and prior
o MySQL Enterprise Monitor, versions 3.3.7.3306 and prior, 3.4.5.4248 and prior, 4.0.2.5168 and prior
o MySQL Server, versions 5.5.59 and prior, 5.6.39 and prior, 5.7.21 and prior
o Oracle Access Manager, versions 10.1.4.3.0, 11.1.2.3.0, 12.2.1.3.0
o Oracle Adaptive Access Manager, version 11.1.2.3.0
o Oracle Agile Engineering Data Management, versions 6.1.3, 6.2.0, 6.2.1
o Oracle Agile PLM Framework, version 9.3.6
o Oracle Agile Product Lifecycle Management for Process, versions 6.1.1.6, 6.2.0.0, 6.2.1.0
o Oracle Application Testing Suite, versions 12.5.0.3, 13.1.0.1, 13.2.0.1
o Oracle Banking Corporate Lending, versions 12.3.0, 12.4.0, 12.5.0, 14.0.0
o Oracle Banking Enterprise Collections, version 2.6
o Oracle Banking Enterprise Originations, version 2.6
o Oracle Banking Enterprise Product Manufacturing, version 2.6
o Oracle Banking Payments, versions 12.3.0, 12.4.0, 12.5.0, 14.0.0
o Oracle Banking Platform, versions 2.4, 2.5, 2.6
o Oracle Big Data Discovery, version 1.6.0
o Oracle Business Intelligence Data Warehouse Administration Console, version 11.1.1.6.4
o Oracle Business Intelligence Enterprise Edition, versions 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle Communications Calendar Server, version 8.x
o Oracle Communications Contacts Server, version 8.x
o Oracle Communications EAGLE LNP Application Processor, versions 10.1.0.0.0 and prior
o Oracle Communications Messaging Server, version 8.x
o Oracle Communications MetaSolv Solution, version 6.3.0
o Oracle Communications Network Charging and Control, versions 4.4.1.5.0, 5.0.0.1.0, 5.0.0.2.0, 5.0.1.0.0, 5.0.2.0.0
o Oracle Communications Network Intelligence, version 7.3.x
o Oracle Communications Order and Service Management, versions 7.2.4.3.0, 7.3.0.1.x, 7.3.1.0.7, 7.3.5.0.x
o Oracle Communications Unified Inventory Management, version 7.x
o Oracle Data Visualization Desktop, version 12.2.4.1.1
o Oracle Database Server, versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18.1.0.0
o Oracle E-Business Suite, versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7
o Oracle Endeca Information Discovery Integrator, versions 3.1, 3.2
o Oracle Endeca Information Discovery Studio, versions 7.6.1.0.0, 7.7.0.0.0
o Oracle Endeca Server, version 7.7
o Oracle Enterprise Repository, versions 11.1.1.7.0, 12.1.3.0.0
o Oracle Financial Services Analytical Applications Infrastructure, versions 7.3.x, 8.0.x
o Oracle Financial Services Basel Regulatory Capital Basic, version 8.0.x
o Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach, version 8.0.x
o Oracle Financial Services Hedge Management and IFRS Valuations, versions 8.0.4, 8.0.5
o Oracle Financial Services Market Risk Measurement and Management, version 8.0.5
o Oracle FLEXCUBE Core Banking, versions 11.5.0, 11.6.0, 11.7.0
o Oracle FLEXCUBE Enterprise Limits and Collateral Management, versions 12.3.0, 14.0.0
o Oracle FLEXCUBE Investor Servicing, versions 12.0.4, 12.1.0, 12.3.0, 12.4.0
o Oracle FLEXCUBE Private Banking, versions 12.0.0, 12.1.0
o Oracle FLEXCUBE Universal Banking, versions 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0, 12.4.0, 14.0.0
o Oracle Fusion Applications , versions 11.1.2 through 11.1.9
o Oracle Fusion Middleware, versions 11.1.1.7, 11.1.1.9, 11.1.2.3, 12.1.3.0, 12.2.1.2, 12.2.1.3
o Oracle Fusion Middleware MapViewer, versions 11.1.1.7.0, 11.1.1.9.0
o Oracle GoldenGate, version 12.2.0.1
o Oracle GoldenGate Veridata, versions 11.2.0.1.2, 12.1.3.0.0
o Oracle Hospitality Cruise Fleet Management System, version 9.x
o Oracle Hospitality Guest Access, versions 4.2.0, 4.2.1
o Oracle Hospitality Reporting and Analytics, version 9.0
o Oracle Hospitality Simphony, versions 2.7, 2.8, 2.9, 2.10
o Oracle Hospitality Simphony First Edition, versions 1.6, 1.7
o Oracle Hospitality Suite8, version 8.x
o Oracle HTTP Server, versions 12.1.3, 12.2.1.2
o Oracle Java SE, versions 6u181, 7u161, 7u171, 8u152, 8u162, 10
o Oracle Java SE Embedded, versions 8u152, 8u161
o Oracle JRockit, version R28.3.17
o Oracle Managed File Transfer, versions 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle Mobile Security Suite, version 3.0.1
o Oracle Outside In Technology, version 8.5.3
o Oracle Retail Advanced Inventory Planning, versions 13.2, 13.4, 14.1, 15.0
o Oracle Retail Back Office, versions 13.4.9, 14.0.4, 14.1.3
o Oracle Retail Central Office, versions 13.4.9, 14.0.4, 14.1.3
o Oracle Retail Customer Engagement, version 16.0
o Oracle Retail EFTLink, versions 1.1.124, 15.0.1, 16.0.2
o Oracle Retail Insights, versions 14.0, 14.1, 15.0, 16.0
o Oracle Retail Integration Bus, version 13.2
o Oracle Retail Invoice Matching, versions 12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0
o Oracle Retail Merchandising System, version 15.0
o Oracle Retail Order Broker, versions 5.0, 5.1, 5.2, 15.0, 16.0
o Oracle Retail Order Management System, versions 4.0, 4.5, 4.7, 5.0
o Oracle Retail Point-of-Service, versions 13.3.8, 13.4.9, 14.0.4, 14.1.3
o Oracle Retail Predictive Application Server, versions 13.4.3, 14.0.3, 14.1.3
o Oracle Retail Price Management, versions 12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0
o Oracle Retail Returns Management, versions 2.3.8, 2.4.9, 14.0.4, 14.1.3
o Oracle Retail Store Inventory Management, versions 12.0.12, 13.0.7, 13.1.9, 13.2.9, 14.0.4, 14.1.3, 15.0.2, 16.0.1
o Oracle Retail Xstore Point of Service, versions 6.0.11, 6.5.11, 7.0.6, 7.1.6, 15.0.1, 16.0.2
o Oracle Secure Global Desktop (SGD), version 5.3
o Oracle Security Service, versions 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle Transportation Management, versions 6.2, 6.4.3
o Oracle Tuxedo, version 12.1.1.0.0
o Oracle Utilities Framework, versions 2.2.0, 4.2.0, 4.3.0
o Oracle VM VirtualBox, versions prior to 5.1.36, prior to 5.2.10
o Oracle WebCenter Content, versions 11.1.1.9.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle WebCenter Portal, versions 12.2.1.2.0, 12.2.1.3.0
o Oracle WebCenter Sites, versions 11.1.1.8.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle WebLogic Portal, version 10.3.6.0.0
o Oracle WebLogic Server, versions 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3
o OSS Support Tools, versions prior to 18.2
o PeopleSoft Enterprise HCM, version 9.2
o PeopleSoft Enterprise HCM Shared Components, version 9.2
o PeopleSoft Enterprise PeopleTools, versions 8.54, 8.55, 8.56
o PeopleSoft Enterprise PRTL Interaction Hub, version 9.1
o PeopleSoft Enterprise PT PeopleTools, versions 8.54, 8.55, 8.56
o Primavera P6 Enterprise Project Portfolio Management, versions 16.2, 17.1 – 17.12
o Primavera Unifier, versions 16.x, 17.x
o Real-Time Decisions (RTD) Solutions, version 3.2.0.0.0
o Siebel Applications, version 17.0
o Solaris, versions 10, 11.3
o Solaris Cluster, version 4.3
o Sun ZFS Storage Appliance Kit (AK), versions prior to 8.7.17
□ 해결 방안
o "Oracle Critical Patch Update Advisory – April 2018“ 문서 및 패치사항을 검토하고 벤더사 및 유지보수 업체와 협의/검토 후 패치 적용 [1]
o JAVA SE 사용자는 설치된 제품의 최신 업데이트를 다운로드[2] 받아 설치하거나, Java 업데이트 자동 알림 설정을 권고 [3]
□ 기타 문의사항
o 한국인터넷진흥원 인터넷침해대응센터: 국번없이 118
[참고사이트]
[1] http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
[2] http://www.oracle.com/technetwork/java/javase/downloads/index.html
[3] http://www.java.com/ko/download/help/java_update.xml
o 오라클社 CPU에서 자사 제품의 보안 취약점 254개에 대한 패치를 발표 [1]
※ CPU(Critical Patch Update) : 오라클 중요 보안 업데이트
o 영향 받는 버전의 사용자는 악성코드 감염 등에 취약할 수 있으므로, 아래 해결방안에 따라 최신버전으로 업데이트 권고
□ 영향을 받는 시스템
o Enterprise Manager Base Platform, versions 12.1.0.5, 13.2.0.0
o Enterprise Manager for MySQL Database, version 12.1.0.4
o Enterprise Manager for Virtualization, version 13.2
o Enterprise Manager Ops Center, versions 12.2.2, 12.3.3
o Hardware Management Pack, versions prior to 2.4.3
o Instantis EnterpriseTrack, versions 17.1, 17.2
o Integrated Lights Out Manager (ILOM), versions 3.x, 4.x
o JD Edwards EnterpriseOne Tools, version 9.2.2
o JD Edwards World Security, versions A9.2, A9.3, A9.4
o Management Pack for Oracle GoldenGate, version 11.2.1.0.13
o MICROS Handheld Terminal, versions Prior to Fusion 2.03.0.0.021R
o MICROS Lucas, version 2.9.5
o MySQL Cluster, versions 7.2.27 and prior, 7.3.16 and prior, 7.4.14 and prior, 7.5.5 and prior
o MySQL Enterprise Monitor, versions 3.3.7.3306 and prior, 3.4.5.4248 and prior, 4.0.2.5168 and prior
o MySQL Server, versions 5.5.59 and prior, 5.6.39 and prior, 5.7.21 and prior
o Oracle Access Manager, versions 10.1.4.3.0, 11.1.2.3.0, 12.2.1.3.0
o Oracle Adaptive Access Manager, version 11.1.2.3.0
o Oracle Agile Engineering Data Management, versions 6.1.3, 6.2.0, 6.2.1
o Oracle Agile PLM Framework, version 9.3.6
o Oracle Agile Product Lifecycle Management for Process, versions 6.1.1.6, 6.2.0.0, 6.2.1.0
o Oracle Application Testing Suite, versions 12.5.0.3, 13.1.0.1, 13.2.0.1
o Oracle Banking Corporate Lending, versions 12.3.0, 12.4.0, 12.5.0, 14.0.0
o Oracle Banking Enterprise Collections, version 2.6
o Oracle Banking Enterprise Originations, version 2.6
o Oracle Banking Enterprise Product Manufacturing, version 2.6
o Oracle Banking Payments, versions 12.3.0, 12.4.0, 12.5.0, 14.0.0
o Oracle Banking Platform, versions 2.4, 2.5, 2.6
o Oracle Big Data Discovery, version 1.6.0
o Oracle Business Intelligence Data Warehouse Administration Console, version 11.1.1.6.4
o Oracle Business Intelligence Enterprise Edition, versions 11.1.1.7.0, 11.1.1.9.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle Communications Calendar Server, version 8.x
o Oracle Communications Contacts Server, version 8.x
o Oracle Communications EAGLE LNP Application Processor, versions 10.1.0.0.0 and prior
o Oracle Communications Messaging Server, version 8.x
o Oracle Communications MetaSolv Solution, version 6.3.0
o Oracle Communications Network Charging and Control, versions 4.4.1.5.0, 5.0.0.1.0, 5.0.0.2.0, 5.0.1.0.0, 5.0.2.0.0
o Oracle Communications Network Intelligence, version 7.3.x
o Oracle Communications Order and Service Management, versions 7.2.4.3.0, 7.3.0.1.x, 7.3.1.0.7, 7.3.5.0.x
o Oracle Communications Unified Inventory Management, version 7.x
o Oracle Data Visualization Desktop, version 12.2.4.1.1
o Oracle Database Server, versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18.1.0.0
o Oracle E-Business Suite, versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7
o Oracle Endeca Information Discovery Integrator, versions 3.1, 3.2
o Oracle Endeca Information Discovery Studio, versions 7.6.1.0.0, 7.7.0.0.0
o Oracle Endeca Server, version 7.7
o Oracle Enterprise Repository, versions 11.1.1.7.0, 12.1.3.0.0
o Oracle Financial Services Analytical Applications Infrastructure, versions 7.3.x, 8.0.x
o Oracle Financial Services Basel Regulatory Capital Basic, version 8.0.x
o Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach, version 8.0.x
o Oracle Financial Services Hedge Management and IFRS Valuations, versions 8.0.4, 8.0.5
o Oracle Financial Services Market Risk Measurement and Management, version 8.0.5
o Oracle FLEXCUBE Core Banking, versions 11.5.0, 11.6.0, 11.7.0
o Oracle FLEXCUBE Enterprise Limits and Collateral Management, versions 12.3.0, 14.0.0
o Oracle FLEXCUBE Investor Servicing, versions 12.0.4, 12.1.0, 12.3.0, 12.4.0
o Oracle FLEXCUBE Private Banking, versions 12.0.0, 12.1.0
o Oracle FLEXCUBE Universal Banking, versions 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0, 12.3.0, 12.4.0, 14.0.0
o Oracle Fusion Applications , versions 11.1.2 through 11.1.9
o Oracle Fusion Middleware, versions 11.1.1.7, 11.1.1.9, 11.1.2.3, 12.1.3.0, 12.2.1.2, 12.2.1.3
o Oracle Fusion Middleware MapViewer, versions 11.1.1.7.0, 11.1.1.9.0
o Oracle GoldenGate, version 12.2.0.1
o Oracle GoldenGate Veridata, versions 11.2.0.1.2, 12.1.3.0.0
o Oracle Hospitality Cruise Fleet Management System, version 9.x
o Oracle Hospitality Guest Access, versions 4.2.0, 4.2.1
o Oracle Hospitality Reporting and Analytics, version 9.0
o Oracle Hospitality Simphony, versions 2.7, 2.8, 2.9, 2.10
o Oracle Hospitality Simphony First Edition, versions 1.6, 1.7
o Oracle Hospitality Suite8, version 8.x
o Oracle HTTP Server, versions 12.1.3, 12.2.1.2
o Oracle Java SE, versions 6u181, 7u161, 7u171, 8u152, 8u162, 10
o Oracle Java SE Embedded, versions 8u152, 8u161
o Oracle JRockit, version R28.3.17
o Oracle Managed File Transfer, versions 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle Mobile Security Suite, version 3.0.1
o Oracle Outside In Technology, version 8.5.3
o Oracle Retail Advanced Inventory Planning, versions 13.2, 13.4, 14.1, 15.0
o Oracle Retail Back Office, versions 13.4.9, 14.0.4, 14.1.3
o Oracle Retail Central Office, versions 13.4.9, 14.0.4, 14.1.3
o Oracle Retail Customer Engagement, version 16.0
o Oracle Retail EFTLink, versions 1.1.124, 15.0.1, 16.0.2
o Oracle Retail Insights, versions 14.0, 14.1, 15.0, 16.0
o Oracle Retail Integration Bus, version 13.2
o Oracle Retail Invoice Matching, versions 12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0
o Oracle Retail Merchandising System, version 15.0
o Oracle Retail Order Broker, versions 5.0, 5.1, 5.2, 15.0, 16.0
o Oracle Retail Order Management System, versions 4.0, 4.5, 4.7, 5.0
o Oracle Retail Point-of-Service, versions 13.3.8, 13.4.9, 14.0.4, 14.1.3
o Oracle Retail Predictive Application Server, versions 13.4.3, 14.0.3, 14.1.3
o Oracle Retail Price Management, versions 12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0
o Oracle Retail Returns Management, versions 2.3.8, 2.4.9, 14.0.4, 14.1.3
o Oracle Retail Store Inventory Management, versions 12.0.12, 13.0.7, 13.1.9, 13.2.9, 14.0.4, 14.1.3, 15.0.2, 16.0.1
o Oracle Retail Xstore Point of Service, versions 6.0.11, 6.5.11, 7.0.6, 7.1.6, 15.0.1, 16.0.2
o Oracle Secure Global Desktop (SGD), version 5.3
o Oracle Security Service, versions 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle Transportation Management, versions 6.2, 6.4.3
o Oracle Tuxedo, version 12.1.1.0.0
o Oracle Utilities Framework, versions 2.2.0, 4.2.0, 4.3.0
o Oracle VM VirtualBox, versions prior to 5.1.36, prior to 5.2.10
o Oracle WebCenter Content, versions 11.1.1.9.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle WebCenter Portal, versions 12.2.1.2.0, 12.2.1.3.0
o Oracle WebCenter Sites, versions 11.1.1.8.0, 12.2.1.2.0, 12.2.1.3.0
o Oracle WebLogic Portal, version 10.3.6.0.0
o Oracle WebLogic Server, versions 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3
o OSS Support Tools, versions prior to 18.2
o PeopleSoft Enterprise HCM, version 9.2
o PeopleSoft Enterprise HCM Shared Components, version 9.2
o PeopleSoft Enterprise PeopleTools, versions 8.54, 8.55, 8.56
o PeopleSoft Enterprise PRTL Interaction Hub, version 9.1
o PeopleSoft Enterprise PT PeopleTools, versions 8.54, 8.55, 8.56
o Primavera P6 Enterprise Project Portfolio Management, versions 16.2, 17.1 – 17.12
o Primavera Unifier, versions 16.x, 17.x
o Real-Time Decisions (RTD) Solutions, version 3.2.0.0.0
o Siebel Applications, version 17.0
o Solaris, versions 10, 11.3
o Solaris Cluster, version 4.3
o Sun ZFS Storage Appliance Kit (AK), versions prior to 8.7.17
□ 해결 방안
o "Oracle Critical Patch Update Advisory – April 2018“ 문서 및 패치사항을 검토하고 벤더사 및 유지보수 업체와 협의/검토 후 패치 적용 [1]
o JAVA SE 사용자는 설치된 제품의 최신 업데이트를 다운로드[2] 받아 설치하거나, Java 업데이트 자동 알림 설정을 권고 [3]
□ 기타 문의사항
o 한국인터넷진흥원 인터넷침해대응센터: 국번없이 118
[참고사이트]
[1] http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
[2] http://www.oracle.com/technetwork/java/javase/downloads/index.html
[3] http://www.java.com/ko/download/help/java_update.xml