Oracle plugs 122 security holes

By

Database vendor flips switch on vulnerability score reporting.


Oracle has released a "critical patch update" (CPU) that plugs 122 security vulnerabilities. The flaws are spread out over the company's databases, enterprise applications, developer tools and middleware.

Oracle issues its security updates on a quarterly schedule and this quarter for the first time used a system that assigns a severity score to its bugs on a scale of 1 to 10.

The enterprise software vendor also started providing additional information, which among things indicates if a flaw can be exploited by remote attackers without any authentication credentials. The system is designed to help administrators identify the most urgent issues.

The most severely ranked security flaw was assigned a "base score" of 7 and affects Oracle Application Express. The company's flagship database received a total of 22 fixes, with the most severe ranked at 4.2.

The scores are assigned using the industry standard Common Vulnerability Scoring System (CVSS) which is also used by Cisco Systems.

David Litchfield with Next Generation Security Software criticised Oracle for failing to deliver its patches on all platforms. Patches for Oracle databases 9.2.0.6 and 10.1.0.5 won't be available until the end of this month. Users running Oracle 10.2.0.1 on Linux on Power servers have to wait until the end of October too, as do users running Oracle 10.2.0.2 on Windows.

"After a successful July 2006 critical patch update release, where Oracle had all the patches ready, it's disappointing to see Oracle slipping back into their old, bad habits," Litchfield charged.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Log In

  |  Forgot your password?