Menu
Oracle fixes Struts and Shadow Brokers exploits in huge patch release

Oracle fixes Struts and Shadow Brokers exploits in huge patch release

The quarterly Oracle patch update fixes almost 300 vulnerabilities

IDG

IDG

Oracle has released a record 299 security fixes for vulnerabilities in its products, including patches for a widely exploited vulnerability in the Apache Struts framework and a Solaris exploit supposedly used by the U.S. National Security Agency.

The Struts vulnerability allows for remote code execution on Java web servers and was patched on March 6. Attackers have quickly adopted it and have used it in widespread attacks since then.

Oracle uses Apache Struts 2 in several of its products, which is why Tuesday's critical patch update (CPU) fixed 25 instances of the vulnerability in Oracle Communications, Retail and Financial Services applications, as well as in the MySQL Enterprise Monitor, Oracle WebCenter Sites, Oracle WebLogic Server and the Siebel E-Billing app.

The company also fixed the vulnerability behind the EXTREMEPARR exploit for Solaris 10 that was leaked recently by a group called Shadow Brokers as part of a larger data dump of alleged NSA cyber tools. Another Solaris exploit that was part of the same arsenal and was dubbed EBBISLAND has been patched since 2012 in Solaris 10 Update 11, Oracle said.

Oracle's quarterly patch bundle contains fixes for 40 vulnerabilities that are rated as critical, 25 of which have the highest severity score of 10 in the Common Vulnerability Scoring System (CVSS). Overall, 162 out of the 299 patched vulnerabilities are remotely exploitable.

Oracle's applications for specific industry sectors -- financial services, retail, communications, utilities, hospitality, health sciences and insurance -- account for almost 40 percent of all security fixes this quarter, according to an analysis by security vendor ERPScan.

Oracle business-critical applications like Oracle PeopleSoft, E-Business Suite, JD Edwards, Siebel CRM and the Primavera Products Suite received 83 security fixes.

"Nowadays, hackers set their eyes on enterprises more than on individuals, as they understood that this option is more profitable," said Alexander Polyakov, CTO at ERPScan. "Taking into account that Oracle’s products are installed in the largest enterprises, these applications can be the ultimate target."

On the database side, Oracle patched 39 vulnerabilities in MySQL and 3 in its Oracle Database Server. Java also received 8 security fixes.

Triaging and deploying the patches that make up this Oracle CPU, the largest ever for the company, will be a lot of work for systems administrators. The size of Oracle's quarterly updates has steadily increased over the years, raising the question of whether a monthly update cycle instead of a quarterly one wouldn't be more appropriate.


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments