Oracle issues 136 patches to address major security threats
System admins tested as Oracle releases confetti of patches across entire product range
Oracle’s quarterly update promises to be a mammoth task for system administrators, delivering 136 patches for flaws across the entire spectrum of Oracle packages.
The usual suspects are being patched in the critical patch update, including Java. But patches are also available for the Oracle database, and JD Edwards, PeopleSoft, Siebel and Sun Microsystems product ranges – Oracle has acquired a lot of companies over the years.
It should be noted that Oracle has a history of delivering large patch updates. Indeed, its last quarter update was in January, which addressed a staggering 248 vulnerabilities according to security firm ERPScan.
Patch Breakdown
At least five of the vulnerabilities in the latest update have been given the highest severity rating.
“This Critical Patch Update provides fixes for a wide range of product families including: Oracle Database Server, Oracle E-Business Suite, Oracle Fusion Middleware, Oracle Sun Products, Oracle Java SE, and Oracle MySQL,” said Oracle in a blog post on the matter. “Oracle recommends this Critical Patch Update be applied as soon as possible.”
The largest amount of patches (31) are for Oracle MySQL. Oracle Fusion Middleware meanwhile gets 22 patches, Oracle Sun System Product gets 18, Oracle PeopleSoft gets 15, and Oracle Java SE gets nine.
Tightening Security
Oracle has been busy on the security front recently. Last month it issued an emergency patch for Java to prevent hackers from remotely executing code without the need for user credentials.
It also recently added Leon Panetta, former US secretary of defence and former director of the Central Intelligence Agency (CIA), to its board of directors in an effort to improve its security credentials.
In January, Australian security researcher David Litchfield revealed that he had uncovered a “major” back door in versions of Oracle’s E-Business Suite.
The back door could be used by attackers to gain complete control of a database, and was a result of a misconfiguration flaw.
Oracle patched that flaw in its January patch update.