Critical patches issued for Oracle products

Share this article:
Oracle on Tuesday issued 41 patches to address vulnerabilities in its products, the most critical of which could allow an attacker to gain complete control of backup systems, databases or web applications.

“There are quite a few critical or high-risk vulnerabilities in this patch,” Amichai Shulman, CTO of Imperva, told SCMagazineUS.com Wednesday. “Many more than we are used to seeing in previous ones.”

The 41 patches are listed as critical overall and Oracle strongly recommended users apply fixes as soon as possible. Five of the vulnerabilities – four affecting the product Secure Backup (for Windows) and one affecting WebLogic Server -- were listed as a 10 on Oracle's one to 10-point Common Vulnerability Scoring System (CVSS).

Secure Backup is a product aimed at establishing a regular policy-based encrypted backup of all databases in an enterprise. The four vulnerabilities in this product, each receiving a 10 rating, affect Windows versions of the product and could enable an internal attacker to gain complete control of backup system without any required credentials.

“Anyone within the organization with network access to a Secure Backup system can do that,” Shulman said.

Five additional vulnerabilities in Secure Backup, all rated five on the CVSS, also were patched.

Also listed with a 10 rating is a vulnerability in Oracle's WebLogic Server. Oracle acquired this product with the purcahse of enterprise infrastructure software company BEA Systems in January 2008. The implication of this vulnerability is that it could enable an external attacker to take complete control over a web application, Shulman said.

Four other vulnerabilities were identified in the BEA product suite affecting WebLogic Portal and WebLogic Server, rated from 2.6 to 6.8 on the CVSS.

Ten vulnerabilities were patched for the popular Oracle Database. These are listed from 1.7 to 5.5 on the CVSS, but Shulman said they pose a high risk to organizations because they could enable an attacker to potentially take control of databases.

Patches also were issued for vulnerabilities in the following products: Oracle TimesTen Database, (one vulnerability rated 7.5 on the CVSS), Oracle Application Server (four vulnerabilities rated 2.1 to five), Oracle Collaboration Suite (one vulnerability rated four), Oracle E-Business Suite (four vulnerabilities rated one to 5.5), Oracle Enterprise Manager (one vulnerability rated 5.5), and PeopleSoft and JD Edwards Suite (six vulnerabilities rated four to 6.5).
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Kevin Mitnick to sell zero-day exploits

Kevin Mitnick's new venture will develop and procure zero-day exploits, then sell them for $100,000 or more.

FBI warns of potential cyber attacks launched by ISIS hacktivists

Following U.S. military airstrikes in the Middle East, the FBI has issued a warning regarding possible cyber threats aimed at U.S. networks and critical infrastructure by hacktivists in support of ISIS.

Report: 75 million records compromised so far in 2014

Report: 75 million records compromised so far in ...

An updated report indicates that since this time last year, breaches have increased by 29.4 percent, with 568 breaches occurring this year.