[SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (details) Apr 01 2014 08:40AM
Security Explorations (contact security-explorations com) (1 replies)

Hello All,

Security Explorations decided to release technical details and
accompanying Proof of Concept codes for security vulnerabilities
discovered in the environment of Oracle [1] Java Cloud Service
[2]. All relevant materials can be found at the following location:


This publication is made as a result of unsatisfactory Oracle
vulnerability handling process.

Two months after the initial report, Oracle has not provided
information regarding successful resolution of the reported
vulnerabilities in their commercial cloud data centers (US1 and
EMEA1 respectively).

The company has not provided a monthly status report for the
reported vulnerabilities for Mar 2014 (to be received around the
24th of each month).

Instead, a year and a half after the commercial availability of
the service, Oracle communicates that it is still working on cloud
vulnerability handling policies. Additionally, the company openly
admits that it cannot promise whether it will be communicating
resolution of security vulnerabilities affecting their cloud data
centers in the future.

Oracle production cloud, which has been in the company offering
since 2012, did offer the following (among others):
- Java Security Sandbox Bypass Issues. This includes both simple
instances of widely discussed Reflection API flaws [3] as well
as vulnerabilities that exposed rather weak understanding of Java
security model and its attack techniques by Oracle engineers,
- Java API Whitelisting Rules Bypass Issues (again, primarily due
to the Reflection API),
- shared WebLogic server administrator credentials (same passwords
for all customers in a given regional data center, easy to obtain
from the environment configuration),
- Plaintext / security sensitive passwords in Policy Store (this
includes passwords of users usually associated with administrator
privileges in Fusion Middleware software stack),
- old Java SE software used as the base for the service (approx. 150
security fixes incorporated into Java SE software since the end of
2012 / beginning of 2013 were missing from the environment).

Security Explorations hopes that the publication of SE-2013-01 project
details puts a valuable perspective on Oracle security and engineering

We take this opportunity to encourage all customers of Oracle Java Cloud
Service that signed up for the service between Jun 2012 and Jan 2013 in
either US1 or EMEA1 commercial data centers to make use of the published
materials as a supporting evidence for any refund requests from Oracle
filed on the basis of unsatisfactory security level of the services offered.

Thank you.

Best Regards,
Adam Gowdiak

Security Explorations
"We bring security research to the new level"

[1] Oracle Corporation (http://www.oracle.com)
[2] Oracle Java Cloud Service
[3] SE-2012-01 Project, Security Vulnerabilities in Java SE

[ reply ]
Re: [SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service (details) Apr 01 2014 12:23PM
Security Explorations (contact security-explorations com)


Privacy Statement
Copyright 2010, SecurityFocus