PR.com: Business Directory, Press Releases, Jobs, Products, Services, Articles
 
Businesses Articles Press Releases Follow @PRcom
Press Release Pricing | News by Category | News by Country | News by US Region | Recent News | PR.com News on Your Site
 

Press Releases

 
ERPScan

Press Release


Receive press releases from ERPScan: By Email RSS Feeds:

ERPScan Took a Closer Look at Oracle EBS Security, 6 Vulnerabilities Patched in Recent Update


ERPScan has announced today that Oracle released updates for 6 vulnerabilities identified by ERPScan researchers.

Palo Alto, CA, October 24, 2015 --(PR.com)-- ERPScan, the most honored SAP Security and Oracle Security provider focused on ERP and Enterprise Business Application security, has announced today that Oracle released updates for 6 vulnerabilities identified by ERPScan researchers.

According to the recent Critical Patch Update for October 2015, 154 vulnerabilities were fixed in total by Oracle in its set of enterprise products. Among 12 vulnerabilities closed in Oracle E-Business Suite, there were 6 exposed by ERPScan Research team. These issues include XSS Vulnerability, SQL Injection vulnerability, several XXE Injection Vulnerabilities ([1], [2]), and User Enumeration vulnerability. Some of those issues (SQL Injection, XXE Injections) allow an attacker to gain unauthorized access to the business application with administrator rights.

The vulnerabilities were discovered in the core platform of Oracle’s most popular Enterprise application - Oracle EBS (E-Business Suite). Some of the most critical business applications based on E-Business Suite platform are affected such as Value Chain Execution suite, Value Chain Planning, Advanced Procurement, Supply Chain Management, Project Portfolio Management, Human Capital Management, Financial Management, Service Management, and Customer Relationship Management. Listed applications store and process the most valuable corporate data such as HR information, financial data, supplier and customer lists, and others.

The severity of attack impact is limited by the attacker’s skills and imagination. Depending on the application type, a malicious person can carry out the following espionage, sabotage or fraudulent actions:

- Manipulate data about quantity of material resources
- Change the item prices
- Misappropriate funds
- Tamper credit limits
- Steal credit card data
- Modify financial reports
- And others

This is the 16th update since 2008 where ERPScan researchers were acknowledged by Oracle for their help in solving security issues in their solutions.

“During our review of Oracle security, we identified dozens of vulnerabilities affecting Oracle EBS Security. We managed to find at least one example of every vulnerability from OWASP TOP 10.” - Alexey Tyurin, Head of Oracle Security department at ERPScan

They recommend that all companies using Oracle e-Business Suite applications update their systems with the latest patches provided by Oracle to improve the Oracle EBS Security level.

In addition, they recommend their Security services to assess your systems against Oracle EBS security.
Contact Information
ERPScan
Darya Maenkova
650.798.5254
Contact
erpscan.com

Click here to view the list of recent Press Releases from ERPScan
Promote Your Business