Oracle unloads critical patch pile

Article

Oracle unloads critical patch pile

Oracle Corp. released a mammoth security update Tuesday, fixing critical flaws malicious users could exploit to launch damaging code, bypass access restrictions, cause a denial

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

of service or conduct cross-site scripting and SQL injection attacks.

For more information

Read our exclusive: Oracle issues patches, but misses the mark, again.

Read our exclusive: OPatch, wherefore art thou?

The Redwood Shores, Calif.-based vendor offered few details on what the vulnerabilities are and where they reside, though it did describe yesterday's rollout as a critical "collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required (because of interdependencies) by those security patches."

Oracle said the vulnerabilities affect the following products:

  • Oracle Application Server 10g
  • Oracle Collaboration Suite Release 1
  • Oracle Collaboration Suite Release 2
  • Oracle Database 8.x
  • Oracle Database Server 10g
  • Oracle Developer Suite 10g
  • Oracle E-Business Suite 11i
  • Oracle Enterprise Manager 10.x
  • Oracle Enterprise Manager 9.x
  • Oracle9i Application Server
  • Oracle9i Database Enterprise Edition
  • Oracle9i Database Standard Edition
  • PeopleSoft Enterprise Customer Relationship Management (CRM) 8.x
  • PeopleSoft EnterpriseOne Applications 8.x
  • JD Edwards EnterpriseOne 8.x
  • JD Edwards OneWorld 8.x

Danish vulnerability watchdog Secunia said in an advisory that as many as 85 vulnerabilities may affect various Oracle products. Secunia said the glitches include, among other things:

  • A buffer overflow flaw and 17 PL/SQL injection vulnerabilities in Oracle Database 10g and Oracle9i Database Server.
  • A problem in which "some input passed to 'test.jsp' of the Oracle Reports Server isn't properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site."

The French Security Incident Response Team (FrSIRT) also issued an advisory on the patches, saying the flaws could be used "by remote or local attackers" to launch the various exploits.