Oracle issues ‘huge’ patch update

A whopping 78 vulnerabilities are addressed in Oracle's latest CPU.

Patch

Oracle has put out what has been described as a "huge" quarterly Critical Patch Update (CPU), with fixes for 78 vulnerabilities across hundreds of products.

It marks another big patch announcement, following the 66 vulnerability CPU in January.

The hefty update is largely down to Oracle's acquisition of significant companies like PeopleSoft and Sun Microsystems, as well as its own wide range of products, said Amol Sarwate, Vulnerability Labs manager for Qualys.

"Our top priority goes to patching vulnerabilities that attackers can remotely exploit without authentication and where the affected systems could be exposed to the outside world," Sarwate said.

"For Sun users this includes nine vulnerabilities that affect Solaris (CVE-2011-2287, CVE-2011-2245, CVE-2011-2294, CVE-2011-2298) SPARC (CVE-2011-2288, CVE-2011-2299, CVE-2011-2307) and Oracle GlassFish Server(CVE-2011-1511, CVE-2011-2260). Protocols that attackers could use for exploitation include SSH, HTTP, SSL and KSSL."

The next priority for IT managers should be to look at vulnerabilities which could be remotely exploitable but affect products which typically would not be exposed due to network segregation or firewalls, Sarwate said.

This includes patches for Oracle Database Server, Grid Control, Enterprise Manager and PeopleSoft.

"While some of the products may have a legitimate business reason to be exposed outside of the corporate network, we strongly advise organisations to access their network infrastructures and prioritise patches based on their exposure," Sarwate added.

"The CPUs are becoming huge. But due to the diversity of affected products, our guess is that many larger organisations could have specialised teams working on different products in order to make the Oracle quarterly CPU a bit more manageable."

The next Oracle CPU is due for 18 October, which will be the last of 2011. Another will be issued on 17 January.

Head here for Oracle's CPU announcement and breakdown of affected vulnerabilities.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Oracle buys healthcare company Cerner for $28.3 billion
mergers and acquisitions

Oracle buys healthcare company Cerner for $28.3 billion

21 Dec 2021
Wipro taps Oracle to digitize air cargo services
digital transformation

Wipro taps Oracle to digitize air cargo services

13 Dec 2021
Automating the modern data warehouse
Whitepaper

Automating the modern data warehouse

8 Dec 2021
Freedom from manual data management
Whitepaper

Freedom from manual data management

8 Dec 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
Synology DiskStation DS2422+ review: A cube of great capacity
network attached storage (NAS)

Synology DiskStation DS2422+ review: A cube of great capacity

10 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022