A critical patch update from Oracle planned for next Tuesday includes 51 security fixes affecting numerous Oracle products.
According to an advisory posted on the application vendors Web site, 27 of the fixes address issues in Oracles database products, five of which concern vulnerabilities that can be exploited remotely without user authentication.
The vulnerabilities addressed by this update include the Advanced Queuing, Advanced Security Option, core RDBMS, Export, Import, Oracle Database Vault, Oracle Net Services, Oracle Text, Spatial, SQL Execution, Workspace Manager and XML DB components of the Oracle 10g database suite.
Eleven other fixes affect Oracle Application Server, including one with a CVSS (Common Vulnerability Scoring System) score of 6.8—the highest of all the vulnerabilities addressed in the update. The vulnerabilities fixed by Critical Patch Updates are now scored using the standard CVSS version 2.0 scoring, as opposed to the CVSS version 1.0 scoring used previously. The equivalent score using CVSS 1.0 would be 7.0.
Seven of these vulnerabilities may be exploited remotely without authentication, and the components reportedly affected are Oracle Containers for J2EE [Java 2 Platform, Enterprise Edition], Oracle HTPP Server, Oracle Internet Directory, Oracle Portal, Oracle Process Management and Notification and Oracle Single Sign-On.
The company, based in Redwood Shores, Calif., also announced eight security fixes for Oracle E-Business Suite, only one of which can be exploited remotely without authentication. There are two fixes for Oracle Enterprise Manager, both of which are remotely exploitable with no authentication. Finally, the update also includes three security fixes for Oracle PeopleSoft Enterprise products, none of which are exploitable remotely without authentication. There are no new Oracle Collaboration suite fixes in this update.
Oracles last update, issued in July, included 45 security fixes across the companys products.
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.