Call: +44 (0)7759 277220 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Pete Finnigan will be teaching Oracle Security in Tallinn, Estonia and speaking at UKOUG Unix SIG at TVP"] [Next entry: "The second IOUG / Oracle Security Assurance Survey"]

59 Security bugs fixed, 28 remotely expolitable, 13 in the database



Oracle yesterday released the latest in its series of quarterly security patches known as CPU's Critical Patch Updates. Oracle released an advisory detailing the fixes. The patch set contains 59 new security fixes. For me the interesting part are the fixes for the database; 13 in all, 6 of which are for the database server itself and 4 of which may be expolited remotely without authentication. The other interesting thing is the amount of names credited on the advisory. i have not counted but its probably the most i can remember. what does this actually mean?, on the simplest level it means many more people are now interested in and doing someting about database security which has to be a good thing. As always Oracle recommend that you apply this as soon as you can. With remotely exploitable bugs / vulnerabilities this should be obvious.

There has been 4 Comments posted on this article


July 15th, 2010 at 02:04 am

Slavik Markovich says:

Hi Pete,

I believe that the number of names credited is directly related to the fact that the security advisory includes a whole new family of Sun products.



July 16th, 2010 at 10:24 am

Pete says:

Thanks Slavik!!



July 21st, 2010 at 11:14 pm

Debbie Nelson says:

Hello Pete:
I found your blog while googling about Oracle Security Updates. We are new to Oracle and have Oracle 10.2.0.1. We would like to apply security updates but cannot get a straight answer on how to do this when our version is not listed. Do we have to upgrade to 10.2.0.4 and then apply the patches? Are there best practices for applying these patches? Thank you in advance. Debbie Nelson, AGA Medical



July 22nd, 2010 at 01:30 pm

Pete says:

Hi Debbie,

Thanks for your question.

Yes you are right there are no security critical patch updates for unsupported versions (for security patches) of Oracle.

The only way to apply a security patch is to upgrade to the latest supported (for security patches) patch set.

The latest patch set (depending on when you get it) will have the latest CPU fixes in it and cumulatively all that came before. So depending on your timing you may also need to download and apply the latest CPU.

hth

Pete