Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Oracle Patches (Jan2011 CPU) - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Oracle Patches (Jan2011 CPU)

Today, Oracle will release its quarterly patch bundle ("Jan2011 CPU").  The pre-announcement is already out, and it promises quite some "entertainment" for DBAs and Middleware Admins for the next couple weeks.  One thing that certainly stands out from the list is the vulnerability in Oracle Audit Vault with a CVSS score of 10.0, apparently remotely exploitable without authentication.  Always disappointing when a so-called security component makes the system actually more vulnerable.

We'll update this diary later, once the full information becomes available.

 

Daniel

367 Posts
ISC Handler
Not to be overlooked are the listing of PeopleSoft; OpenOffice Suite; and Sun Java Suites with highest CVSS ratings of 5.5; 9.3; and 10.0 respectively.
Anonymous

- http://www.us-cert.gov/current/#oracle_releases_critical_patch_update14
January 19, 2011
"... This update contains the following security fixes:
7 for Oracle Database Server
16 for Oracle Fusion Middleware
2 for Oracle Enterprise Manager Grid Control
16 for Oracle Applications
3 for Oracle Supply Chain Products Suite
11 for Oracle PeopleSoft and JDEdwards Suite
2 for Oracle Industry Applications
23 for Oracle Sun Products Suite
2 for Oracle Open Office Suite ..."
.
Jack

160 Posts

Sign Up for Free or Log In to start participating in the conversation!