Breach, Data Security, Patch/Configuration Management, Vulnerability Management

Oracle fixes 78 flaws; half in Database and Sun Suite

Oracle on Tuesday released its quarterly critical patch update to address 78 vulnerabilities, touching all of its product lines.

In an advisory, the company recommended that customers apply the fixes, which include 16 for its popular database product and 23 for the Sun Products Suite, as soon as possible.

Among the most severe are vulnerabilities (CVE-2011-2261,CVE-2011-0873 and CVE-2011-2288) that affect Oracle Secure Backup, Oracle JRockit and SPARC T3 Series, respectively, Marcus Carey, security researcher at Rapid7, said.

These flaws, which are remotely exploitable and do not require authentication credentials, can result in the takeover of an affected system, Carey told on Tuesday. Public exploits are forthcoming.

"The truth is, there are a lot of vulnerabilities in many organizations," Carey said. "It is important to not let outsiders have access. If organizations designed their networks properly, patching still would be necessary, but remote exploitations could be blocked."

Most users should not have access to SSH or HTTP on a network system, he said.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.