Oracle Shifts to Quarterly Patch Cycle

By Brian Fonseca  |  Posted 2004-11-18 Print this article Print

The database giant now says it will issue security patches four times a year instead of monthly.

Oracle Corp. plans to announce yet another change to its security patch release process.

Three months after adopting a monthly schedule to roll out security fixes, the database management firm says patches will now be issued on a quarterly schedule, beginning January 18, 2005.

It effectively means that Oracle customers will get four Critical Patch Updates a year—January 18, April 12, July 12, and October 18—instead of the 12 promised earlier this year.

Oracle has been heavily criticized in the past for adopting a lackadaisical approach to addressing critical security flaws.

The issue came to a head at the BlackHat conference in Las Vegas this year when research firm NGSS (Next Generation Security Software Ltd.) released details on more than two dozen security holes in Oracle products that had not been fixed.

At the time, NGSS said Oracle was aware of the vulnerabilities—some of them critical—for several months.

Officials from Redwood City, Calif.-based Oracle have confirmed the first security patch offering will include fixes across Oracles database products. No other information was provided on which Oracle database versions will be targeted, or which other software lines would be addressed by the inaugural Critical Patch Update.

In general, the quarterly security patches will address flaws and vulnerabilities on an as-needed basis for Oracle Database, Oracle Application Server, Oracle E-Business Suite, Oracle Enterprise Manager and Oracle Collaboration Suite at the time of each rollout. Security patches offered in preceding Critical Patch Updates will automatically be part of each following quarterly update for customers who may still be unprotected if they missed any prior security updates.

Critical Patch Updates are scheduled to be issued to customers simultaneously via MetaLink, Oracles online support Web site. If no security patches are needed at the time a quarterly update is scheduled than none will be offered.

Click here to read about Oracles first-ever monthly rollup of security patches. Oracle officials said the adoption of a new cycle is an attempt to avoid customer surprise with numerous patch "alerts" and guard against interference with common blackout periods when systems are traditionally not updated.

The company believes that giving customers enough notice to properly prepare for the required patch installations will result in less costs and reduced complexities.

Oracle officials said the company will reserve the right to institute a security patch alert at any time and without warning to customers if vulnerabilities are severe enough to warrant a patch.

Additional reporting by Ryan Naraine. Check out eWEEK.coms for the latest database news, reviews and analysis.
Brian Fonseca is a senior writer at eWEEK who covers database, data management and storage management software, as well as storage hardware. He works out of eWEEK's Woburn, Mass., office. Prior to joining eWEEK, Brian spent four years at InfoWorld as the publication's security reporter. He also covered services, and systems management. Before becoming an IT journalist, Brian worked as a beat reporter for The Herald News in Fall River, Mass., and cut his teeth in the news business as a sports and news producer for Channel 12-WPRI/Fox 64-WNAC in Providence, RI. Brian holds a B.A. in Communications from the University of Massachusetts Amherst.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel