What is the Dell BSAFE Micro-Edition Suite MES ?
On the April 2021 Oracle Critical Patch Update, the top vulnerability affects “Oracle Database – Enterprise Edition Security (Dell BSAFE Micro Edition Suite)”.
But what exactly is this Dell MES ? The answer comes on MES v4.1.6 to v4.5 update 18c / 19c databases (Doc ID 2746801.1) note on My Oracle Support. It explains:
” The BSAFE MES is the underlying encryption libraries used by the Database and associated technologies and products to encrypt data at rest and in transit. Upgrading to MES 4.5 resolves a number of vulnerabilities and provides the latest and most secure encryption ciphers.”
Please note that already on the January 2021 Oracle Release Update (19.10 or 18.13 there was an update of this component and “Anonymous RC4 Cipher” is not supported and does not work anymore.
Other ciphers are deprecated and should not be used anymore, as they are not fully secure:
- Unix Crypt (MD5crypt) Password verified (used with Oracle Internet Directory OID)
- MD4, MD5, DES, and RC4-related algorithms used for instance in Network encryption (recommended to use AES)
- SHA-1 used in DBMS_CRYPTO and Checksum in SQLNET (recommended to use SHA-2)
- TLS 1.0 and TLS 1.1 used to network connection authentication to the database using certificates (recommended to use TLS 1.2)
In my case I had problems not with the database, but with an old OEM Agent, that could not communicate anymore to OEM (after the January RU on OEM). The solution was to remove all deprecated algoritms and find common accepted ones between to old agent and patched OEM.