IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Oracle issues ‘huge’ patch update

A whopping 78 vulnerabilities are addressed in Oracle's latest CPU.

Patch

Oracle has put out what has been described as a "huge" quarterly Critical Patch Update (CPU), with fixes for 78 vulnerabilities across hundreds of products.

It marks another big patch announcement, following the 66 vulnerability CPU in January.

The hefty update is largely down to Oracle's acquisition of significant companies like PeopleSoft and Sun Microsystems, as well as its own wide range of products, said Amol Sarwate, Vulnerability Labs manager for Qualys.

"Our top priority goes to patching vulnerabilities that attackers can remotely exploit without authentication and where the affected systems could be exposed to the outside world," Sarwate said.

"For Sun users this includes nine vulnerabilities that affect Solaris (CVE-2011-2287, CVE-2011-2245, CVE-2011-2294, CVE-2011-2298) SPARC (CVE-2011-2288, CVE-2011-2299, CVE-2011-2307) and Oracle GlassFish Server(CVE-2011-1511, CVE-2011-2260). Protocols that attackers could use for exploitation include SSH, HTTP, SSL and KSSL."

The next priority for IT managers should be to look at vulnerabilities which could be remotely exploitable but affect products which typically would not be exposed due to network segregation or firewalls, Sarwate said.

This includes patches for Oracle Database Server, Grid Control, Enterprise Manager and PeopleSoft.

"While some of the products may have a legitimate business reason to be exposed outside of the corporate network, we strongly advise organisations to access their network infrastructures and prioritise patches based on their exposure," Sarwate added.

"The CPUs are becoming huge. But due to the diversity of affected products, our guess is that many larger organisations could have specialised teams working on different products in order to make the Oracle quarterly CPU a bit more manageable."

The next Oracle CPU is due for 18 October, which will be the last of 2011. Another will be issued on 17 January.

Head here for Oracle's CPU announcement and breakdown of affected vulnerabilities.

Featured Resources

Three ways manual coding is killing your business productivity

...and how you can fix it

Free Download

Goodbye broadcasts, hello conversations

Drive conversations across the funnel with the WhatsApp Business Platform

Free Download

Winning with multi-cloud

How to drive a competitive advantage and overcome data integration challenges

Free Download

Talking to a business should feel like messaging a friend

Managing customer conversations at scale with the WhatsApp Business Platform

Free Download

Recommended

NetSuite champions product ‘Suiteness’, continues international expansion
Business strategy

NetSuite champions product ‘Suiteness’, continues international expansion

30 Sep 2022
NetSuite emphasises importance of full suite adoption, pushes automation
Business strategy

NetSuite emphasises importance of full suite adoption, pushes automation

29 Sep 2022
NetSuite launches SuitePeople tools for automating schedules and tracking attendance
business management

NetSuite launches SuitePeople tools for automating schedules and tracking attendance

28 Sep 2022
NetSuite announces accounts payable automation to boost transfer accuracy and efficiency
Business strategy

NetSuite announces accounts payable automation to boost transfer accuracy and efficiency

28 Sep 2022

Most Popular

BT and Cisco partner to help businesses responsibly dispose of unwanted IT equipment
sustainability

BT and Cisco partner to help businesses responsibly dispose of unwanted IT equipment

5 Oct 2022
What your hybrid workforce needs from their laptops
Advertisement Feature

What your hybrid workforce needs from their laptops

21 Sep 2022
How to secure your hybrid workforce
Advertisement Feature

How to secure your hybrid workforce

23 Sep 2022