Oracle Tuesday issued its second critical patch update for the year, this time patching 36 security holes in its products – including several that can be exploited remotely by an attacker without authentication.
The most serious of the flaws affects Oracle relational database management system running on Windows, which received a Common Vulnerability Scoring System rating of 7.0 out of 10. This flaw can be exploited remotely by attacker without a password or user name for authentication.
The CVSS standard, which was created by the U.S. Homeland Security Departments National Infrastructure Advisory Council, was adopted by Oracle in October. None of the other vulnerabilities addressed by the Oracle release – besides the flaw affecting the relational database management system – rated higher than 4.2.
There are 13 security fixes for the Oracle Database. In addition, 11 security fixes were issued for Oracle E-Business Suite and Applications, five for Oracle Application Server, as well as one each for Oracle Enterprise Manager, Oracle Secure Enterprise and the Oracle Collaboration Suite. There are also four fixes for JD Edwards EnterpriseOne and Oracle PeopleSoft Enterprise.
The release is among the smallest patch loads in several months. In January, Oracles critical patch update addressed 51 flaws, while the companys critical patch update last October contained more than 100 security fixes. The next Critical Patch Update is scheduled for July 17.
Eric Maurice, manager of security in Oracles Global Technology Business Unit, wrote on the companys security blog today that the decision to release quarterly updates has improved product maintenance for customers.
“The predictability provided by the [Critical Patch Update] mechanism is very important to Oracle customers,” he wrote. “It results in enabling customers to plan for the CPUs and install them in their normal maintenance windows, to avoid undue interruptions in their business-critical systems.”
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
