Oracle plugs 122 security holes

By Tom Sanders on Oct 19, 2006 3:53PM

Database vendor flips switch on vulnerability score reporting.

Oracle has released a "critical patch update" (CPU) that plugs 122 security vulnerabilities. The flaws are spread out over the company's databases, enterprise applications, developer tools and middleware.

Oracle issues its security updates on a quarterly schedule and this quarter for the first time used a system that assigns a severity score to its bugs on a scale of 1 to 10.

The enterprise software vendor also started providing additional information, which among things indicates if a flaw can be exploited by remote attackers without any authentication credentials. The system is designed to help administrators identify the most urgent issues.

The most severely ranked security flaw was assigned a "base score" of 7 and affects Oracle Application Express. The company's flagship database received a total of 22 fixes, with the most severe ranked at 4.2.

The scores are assigned using the industry standard Common Vulnerability Scoring System (CVSS) which is also used by Cisco Systems.

David Litchfield with Next Generation Security Software criticised Oracle for failing to deliver its patches on all platforms. Patches for Oracle databases 9.2.0.6 and 10.1.0.5 won't be available until the end of this month. Users running Oracle 10.2.0.1 on Linux on Power servers have to wait until the end of October too, as do users running Oracle 10.2.0.2 on Windows.

"After a successful July 2006 critical patch update release, where Oracle had all the patches ready, it's disappointing to see Oracle slipping back into their old, bad habits," Litchfield charged.

Got a news tip for our journalists? Share it with us anonymously here.

Tags: