Oracle issues ‘huge’ patch update

A whopping 78 vulnerabilities are addressed in Oracle's latest CPU.

Patch

Oracle has put out what has been described as a "huge" quarterly Critical Patch Update (CPU), with fixes for 78 vulnerabilities across hundreds of products.

It marks another big patch announcement, following the 66 vulnerability CPU in January.

The hefty update is largely down to Oracle's acquisition of significant companies like PeopleSoft and Sun Microsystems, as well as its own wide range of products, said Amol Sarwate, Vulnerability Labs manager for Qualys.

Advertisement - Article continues below

"Our top priority goes to patching vulnerabilities that attackers can remotely exploit without authentication and where the affected systems could be exposed to the outside world," Sarwate said.

"For Sun users this includes nine vulnerabilities that affect Solaris (CVE-2011-2287, CVE-2011-2245, CVE-2011-2294, CVE-2011-2298) SPARC (CVE-2011-2288, CVE-2011-2299, CVE-2011-2307) and Oracle GlassFish Server(CVE-2011-1511, CVE-2011-2260). Protocols that attackers could use for exploitation include SSH, HTTP, SSL and KSSL."

The next priority for IT managers should be to look at vulnerabilities which could be remotely exploitable but affect products which typically would not be exposed due to network segregation or firewalls, Sarwate said.

This includes patches for Oracle Database Server, Grid Control, Enterprise Manager and PeopleSoft.

"While some of the products may have a legitimate business reason to be exposed outside of the corporate network, we strongly advise organisations to access their network infrastructures and prioritise patches based on their exposure," Sarwate added.

Advertisement
Advertisement - Article continues below

"The CPUs are becoming huge. But due to the diversity of affected products, our guess is that many larger organisations could have specialised teams working on different products in order to make the Oracle quarterly CPU a bit more manageable."

The next Oracle CPU is due for 18 October, which will be the last of 2011. Another will be issued on 17 January.

Head here for Oracle's CPU announcement and breakdown of affected vulnerabilities.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/business/business-strategy/354921/oracle-expected-to-slash-1000-plus-jobs-in-europe
Business strategy

Oracle expected to slash 1,000-plus jobs in Europe

5 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Most Popular

Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/operating-systems/microsoft-windows/355105/microsoft-puts-windows-development-on-lockdown
Microsoft Windows

Microsoft puts Windows development on lockdown

25 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020