Oracle plugs 122 security holes

By

Database vendor flips switch on vulnerability score reporting.


Oracle has released a "critical patch update" (CPU) that plugs 122 security vulnerabilities. The flaws are spread out over the company's databases, enterprise applications, developer tools and middleware.

Oracle issues its security updates on a quarterly schedule and this quarter for the first time used a system that assigns a severity score to its bugs on a scale of 1 to 10.

The enterprise software vendor also started providing additional information, which among things indicates if a flaw can be exploited by remote attackers without any authentication credentials. The system is designed to help administrators identify the most urgent issues.

The most severely ranked security flaw was assigned a "base score" of 7 and affects Oracle Application Express. The company's flagship database received a total of 22 fixes, with the most severe ranked at 4.2.

The scores are assigned using the industry standard Common Vulnerability Scoring System (CVSS) which is also used by Cisco Systems.

David Litchfield with Next Generation Security Software criticised Oracle for failing to deliver its patches on all platforms. Patches for Oracle databases 9.2.0.6 and 10.1.0.5 won't be available until the end of this month. Users running Oracle 10.2.0.1 on Linux on Power servers have to wait until the end of October too, as do users running Oracle 10.2.0.2 on Windows.

"After a successful July 2006 critical patch update release, where Oracle had all the patches ready, it's disappointing to see Oracle slipping back into their old, bad habits," Litchfield charged.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

China blamed after cyberattack hits Czech Republic

China blamed after cyberattack hits Czech Republic

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?