Oracle patches show a major database vulnerability

By

Updates issued this week by Oracle should be applied immediately, according to Imperva.

Imperva chief technology officer Amichai Shulman claimed that the fact that Oracle has issued 33 patches - ten of which are sealing vulnerabilities in Oracle's database server offering - indicates the severity of the problem.

The patches affect Oracle's Application Server, Secure Backup, Identity Management, E-Business Suite, Enterprise Manager, WebLogic Server and JRockit, as well as PeopleSoft and Siebel tools.

Shulman noted that two of the flaws in Oracle's Secure Backup earned scores of nine and ten out of ten on the CVSS risk rating. The JRockit flaw also scored a ten.

"The scale of the problem is such that, if companies do not patch, then they could end up leaking customer account data, including credit and debit card details, to hackers on remote access,” said Shulman.

He further claimed that two vulnerabilities on the Oracle database server are remotely exploitable without any authentication being required. This is not unheard of, but it does indicate that there is a vulnerability in the network protocol layer.

Shulman explained that these vulnerabilities mean a hacker can attack the database without authenticating to the system or logging in, meaning that a major attack could go undetected by the IT manager of the system concerned.

Shulman said: “Worryingly, since the E-Business suite touches and transacts a lot of critical data - including the usual suspects such as social security numbers, debit/credit cards and so on - as well as important corporate information, including customer lists or financials, this could result in data leaking out without any knowledge on the part of the IT managers concerned.

“It's very important, therefore, that anyone using Oracle products visit the software company's portal and update their applications, as a failure to patch could result in a very serious data leakage situation.”

See original article on scmagazineuk.com

Oracle patches show a major database vulnerability
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?