Security threats Toolkit

Oracle releases fixes for 101 flaws

Tags:
Patch,
Flaw

Joris Evers CNET News.com

Published: 18 Oct 2006 09:20 BST

As part of its quarterly patch cycle, Oracle released fixes on Tuesday for 101 security vulnerabilities across its products.

The Critical Patch Update includes remedies for 63 flaws related to Oracle's widely-used database products. There are also patches for 14 vulnerabilities in Application Server, 13 related to E-Business Suite, eight in PeopleSoft products and one each in Oracle Pharmaceuticals and JD Edwards software.

"In terms of critical fixes, the majority of them lie within the application server product," said Darius Wiles, the senior manager for security alerts at Oracle. "There is a number that could be exploited both remotely and without authentication, and those are the ones that customers should be most concerned about and fix as soon as possible."

Oracle's October security update is the first of its quarterly bulletins to contain severity ratings. Also, the alert now more clearly denotes which flaws could be exploited remotely by anonymous attackers, the most serious type of vulnerability.

Many of the issues are significant. Thirty of the Oracle Database related flaws open systems up to unauthenticated, remote attacks, according to the alert. For Application Server, 13 flaws carry that risk, as does one in E-Business Suite and one in PeopleSoft products.

Of all the database-related flaws, 35 are in Oracle Application Express, and 25 of those carry the most serious risk. Application Express is an optional installation and isn't used by many Oracle customers, Wiles said. Application Server is more widely used and as such, more systems are at risk of flaws associated with that product, he noted.

"There [are] a lot of fixes this time…they seem to be getting on top of the bug fixing," Pete Finnigan, a security specialist in York, England, wrote on his blog Tuesday. "I am impressed by the new style advisory; it's not perfect, it is much better than it was."

Oracle's next patch day is 16 January.

Did you find this article useful?
462 out of 669 people found this useful

Post a comment

Full Talkback thread

0 comments

More In Security threats

Company/Topic Alerts

Create a new alert from the list below:

Related Jobs

PeopleSoft HR Consultant

PeopleSoft HR Consultant Job ID GBS-0052927 Job type Full-time Regular Work country United Kingdom Work city Any city in selected countries Job role ...

Oracle Application Server and DBA - UCL

Oracle Application Server and Database Administrator (Oracle DBA) (London) Ref: Oracle Application Server and Database Administrator 01 UCL are ...

Oracle Application Server Trainers, Northamptonshire

Job Title Oracle Application Server Trainers, Northamptonshire Type Contract Location Northamptonshire Skills Oracle, DBA, Technical, Trainer, ...

Featured Talkback

On the contrary, if vendors were forced to stand behind their products it should increase innovation. It would force more, and better , testing before hitting the sales floor, resulting in fewer updates and less downtime for the consumer. At present the EULA removes responsibility from the vendor, and moves it to the user, which is a step backward. Make the vendor responsibility for their code.