Oracles usual pre-release for the CPU (Critical Patch Update) for October has been released. The pre-release document is usually released the Thursday before the CPU; the CPU is due out next Tuesday the 20th October. The CPU should have been out this Tuesday though but Oracle delayed this CPU because of Open World.
The CPU contains 38 security fixes (16 for the database) but if we consider Oracles internal fixing rate (i.e. security bugs that are not individually recognised on the advisory) may actually indicate that could be 123 silently fixed bugs (who knows!).
The bigger worry is that for this CPU 16 bugs are fixed in the database, one is for the client only and 6 are exploitable remotely without a username and password. The highest CVSS score is 10.0 for Windows and 7.5 for other platforms.
The cynical view when Oracle delayed the release of the CPU before Open World to allow DBA's to attend without worrying about applying patches was that there was bad news coming. Well the number of bug fixes is not astronomical but the news is bad, 6 remotely exploitable bugs without authenication and a CVSS of 10.0 is not exactly good news. The pre-release is now issued after Open World with this news.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "OWASP Leeds meeting slides available"] [Next entry: "Health Data Theft"]
October 2009
- IOUG Data Security Report 2009 is out - 10/02/2009 by 10/02/2009
- 60 million password hashes/second Oracle password cracker available - 10/05/2009 by 10/05/2009
- Oracle Security Worst Practices - 10/06/2009 by 10/06/2009
- How many Security bugs are in the Oracle database software product set - 10/07/2009 by 10/07/2009
- Expert Oracle Practices: Oracle database administration from the oak table - 10/08/2009 by 10/08/2009
- Nice Summary of setting up audit options - 10/09/2009 by 10/09/2009
- Oracle's new Oracle database security and compliance solution - 10/12/2009 by 10/12/2009
- Spoofing users and programs and presenting at OWASP - 10/13/2009 by 10/13/2009
- SQL Injection and a presentation on data security - 10/14/2009 by 10/14/2009
- OWASP Leeds meeting slides available - 10/15/2009 by 10/15/2009
- Oracle's October pre-cpu advisory is released - 10/16/2009 by 10/16/2009
- Health Data Theft - 10/20/2009 by 10/20/2009
- October 2009 Critical Patch Update is out; Paul has a paper on escalation to OSDBA - 10/21/2009 by 10/21/2009
- Mary Ann Davidson fields security questions at Open World - 10/23/2009 by 10/23/2009
- Cold remedies and Oracle Security - 10/26/2009 by 10/26/2009
- A new Oracle Security book.... or three! - 10/27/2009 by 10/27/2009
- Some training and speaking dates - 10/28/2009 by 10/28/2009
- Update to Dennis Yurichevs FPGA cracker plus exploit code for the CPU CVSS 10.0 bug - 10/30/2009 by 10/30/2009
Archives
Syndication
Powered by gm-rss 2.0.0
