Vulnerabilities / Threats
7/13/2010
12:30 PM
50%
50%

Oracle Patches 59 Vulnerabilities

Sun Solaris product suite, Oracle Database Server, Fusion Middleware, and Supply Chain Products Suite vulnerable to remote exploitation, with no authentication required.

Oracle is set to patch 59 vulnerabilities in its products Tuesday as part of its quarterly Critical Patch Update program. Of those vulnerabilities, 21 are in the Solaris product suite.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible," the company said in a statement.

The patch update contains 13 new security fixes for the Oracle Database Server, patching eight different Oracle Database components: Application Express, Export, Listener, Net Foundation Layer, Network Layer, Oracle OLAP, Oracle Secure Backup, and TimesTen In-Memory Database.

Six of the fixes are for Oracle Database Server itself, and four of those vulnerabilities can be remotely exploitable without authentication -- as in, no username or password would be required. Two of the fixes are for the TimesTen In-Memory Database, and can also be exploited remotely, without authentication. Finally, there are five security fixes for Oracle Secure Backup, three of which are remotely exploitable without authentication.

In terms of severity, the vulnerabilities affecting the TimesTen In-Memory Database and Oracle Secure Backup rate a "10" -- the highest possible severity rating -- on Oracle's interpretation of version 2.0 of the common vulnerability scoring system (CVSS), an open standard for rating software vulnerabilities. CVSS takes into account the preconditions required for exploiting a vulnerability, the ease of exploitation, and the impact of a successful attack, using a formula to convert the vulnerability threat into a numeric score between 0 and 10, to help IT managers know which threats to remediate first.

For the Oracle Solaris Products Suite, seven of the 21 vulnerabilities could be remotely exploitable without authentication. The same goes for five of the seven vulnerabilities patched in Oracle Fusion Middleware and for one critical vulnerability in Oracle Enterprise Manager.

For Oracle applications, the Critical Patch Update includes seven new security fixes for Oracle E-Business Suite; five can be remotely exploitable without authentication. Oracle Supply Chain Products Suite gets two fixes, one exploitable remotely without authentication. Finally, the Oracle PeopleSoft and JDEdwards Suite gets eight patches, none of which can be remotely exploitable without authentication.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.