Pete Finnigan's Oracle Security Weblog

Oracle have this evening (UK time) released the latest Critical Patch Update for April 2006. This is similar in structure to the previous CPU's. The level of detail given out by Oracle is about the same as usual. The Oracle advisory is titled http://www.oracle.com/technology/deploy/security/pdf/cpuapr2006.html - (broken link) Oracle Critical Patch Update - April 2006. The biggest noticable difference to previous CPU's is that the number of fixes is lower. The database has 14 fixes for various versions of the database software, one of the fixes also applies to the application server. Collaboration Suite has 4 fixes and also the same fix applied to the database and application server. There are 14 fixes for E-Business Suite and Applications and again the same fix applied to the other products. Enterprise Manager has 2 fixes, one PeopleSoft fix and one JD Edwards fix.

The level of detail is sparse as usual but with some experience it is possible to work out what the bugs are in a lot of the database bugs due to the naming of the guilty packages.

The key addition is the update to the default password scanner released through MetaLink Note 361482.1. Mary Ann Davidson talked about this update during her presentation in Seattle. She said that they had increased the list of default passwords to around 670. The default password list and default password scanner available on my site include around 600 default passwords. I have updates here locally to this list that i have had for sometime now that I just have not had time to process and add to my list and website. I have between 1100 and 1200 default passwords. I have been very busy recently but after I have completed the move of my website I will update my list and let everyone know here. Remember my list is available to all, the tool released by Oracle is restricted to those with metalink accounts. I can understand that its released in relation to patches but it would have been better to have it available from OTN instead.