Menu
Oracle updates leave critical Windows flaw unpatched

Oracle updates leave critical Windows flaw unpatched

Windows users of Oracle's 9.2.0.8 will not get a critical update until April 30

Some Oracle customers using the Windows operating system will have to wait another two weeks to receive a critical software update to their database software, thanks to a glitch that came up in testing the company's latest patches.

On Tuesday, Oracle unveiled its quarterly release of software patches, fixing not only database flaws, but also bugs in a host of other applications. In total, the patches fix 36 vulnerabilities, 13 of which relate directly to the database.

However, the most serious database flaw discussed in April's Critical Patch Update will not actually become available for users of the 9.2.0.8 version of Oracle's database until April 30, due to an issue that was uncovered in testing, said Darius Wiles, a manager with Oracle Security Alerts. The bug affects only the Windows platform and is patched on all other supported versions of the database, he added.

That flaw, known as DB01, is in the Core RDBMS (relational database management system ) used by Oracle's database. It can be remotely exploited over the network and unlike most of the database flaws, an attacker does not need to have authentication rights to the database to exploit the problem.

Wiles said it was the most critical flaw patched by Oracle this month. It is the only database flaw patched this quarter to be given the relatively severe 7.0 rating on the Common Vulnerability Scoring System. All other database patches scored a 3.4 or less.

One security expert says that it looks like this flaw could be used to shut down or gain access to a database. In theory, it could even be exploited to run unauthorized software on the database server, said Alexander Kornbrust, a business director at Red-Database-Security. "I think people will now concentrate on this vulnerability," he said.

Also patched in this quarterly release are Oracle's Application Server, Collaboration Suite, E-Business Suite, and Enterprise Manager, as well as the company's PeopleSoft and JD Edwards applications.

Oracle said that with its upcoming July 17 update it will scale back the number of patches it releases for its server and middleware products. Starting next quarter, the company will not automatically produce patches for certain versions of its products on platforms that are rarely used. "Instead of systematically creating a Critical Patch Updates for those inactive combinations, we will only produce those patches if clients specifically request them," wrote Eric Maurice, a manager in Oracle's Global Technology Business Unit, in a blog posting.

The change will streamline Oracle's testing process, which tests updates for dozens of software products running on about 20 operating system platforms.

Oracle did not say which platform and product combinations it considers "inactive."


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
Show Comments