Vulnerabilities / Threats
7/13/2010
12:30 PM
50%
50%

Oracle Patches 59 Vulnerabilities

Sun Solaris product suite, Oracle Database Server, Fusion Middleware, and Supply Chain Products Suite vulnerable to remote exploitation, with no authentication required.

Oracle is set to patch 59 vulnerabilities in its products Tuesday as part of its quarterly Critical Patch Update program. Of those vulnerabilities, 21 are in the Solaris product suite.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible," the company said in a statement.

The patch update contains 13 new security fixes for the Oracle Database Server, patching eight different Oracle Database components: Application Express, Export, Listener, Net Foundation Layer, Network Layer, Oracle OLAP, Oracle Secure Backup, and TimesTen In-Memory Database.

Six of the fixes are for Oracle Database Server itself, and four of those vulnerabilities can be remotely exploitable without authentication -- as in, no username or password would be required. Two of the fixes are for the TimesTen In-Memory Database, and can also be exploited remotely, without authentication. Finally, there are five security fixes for Oracle Secure Backup, three of which are remotely exploitable without authentication.

In terms of severity, the vulnerabilities affecting the TimesTen In-Memory Database and Oracle Secure Backup rate a "10" -- the highest possible severity rating -- on Oracle's interpretation of version 2.0 of the common vulnerability scoring system (CVSS), an open standard for rating software vulnerabilities. CVSS takes into account the preconditions required for exploiting a vulnerability, the ease of exploitation, and the impact of a successful attack, using a formula to convert the vulnerability threat into a numeric score between 0 and 10, to help IT managers know which threats to remediate first.

For the Oracle Solaris Products Suite, seven of the 21 vulnerabilities could be remotely exploitable without authentication. The same goes for five of the seven vulnerabilities patched in Oracle Fusion Middleware and for one critical vulnerability in Oracle Enterprise Manager.

For Oracle applications, the Critical Patch Update includes seven new security fixes for Oracle E-Business Suite; five can be remotely exploitable without authentication. Oracle Supply Chain Products Suite gets two fixes, one exploitable remotely without authentication. Finally, the Oracle PeopleSoft and JDEdwards Suite gets eight patches, none of which can be remotely exploitable without authentication.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.