Oracle Addresses 128 Vulnerabilities in Massive Critical Patch Update (CPU)

snoopy · Apr 16, 2013

Oracle Addresses 128 Vulnerabilities in Massive Critical Patch Update (CPU)

Oracle on Tuesday released its quarterly Critical Patch Update (CPU) for April, which addressed a whopping 128 security issues across multiple product families.

Most concerning is that a large number of the vulnerabilities listed are remotely exploitable without authentication, including (4) in its flagship Oracle Database Server, all which can be remotely exploitable without authentication, i.e., exploited over a network without the need for a username and password.

The Critical Patch Update contains 29 new security fixes for Oracle Fusion Middleware, 22 of which are remotely exploitable.

Oracle LogoMoving on, the update contains 6 new security fixes for the Oracle E-Business Suite, All remotely exploitable.

While the database giant released 25 new security fixes for MySQL, only (1) was said to be remotely exploitable without authentication.

Oracle also released a Java SE Critical Patch Update to address multiple vulnerabilities affecting the Java Runtime Environment (JRE).

“The Java CPU contains 19 CVEs with CVSS base score of 10 (the highest you can go) indicating that exploiting the vulnerability is not particularly challenging and could give complete control of compromised systems,” said Ross Barrett, Senior Manager of Security Engineering at Rapid7.

“For all of these vulnerabilities, the browser is the vector of exploit,” Barrett said. “For one of those (CVE-2013-1537) some Java server configurations will also be exposed. In total, there are 42 distinct CVEs for Java this quarter, of which 39 are through the Java Web Start plugin and can be remotely exploited without authentication.”

Other vulnerabilities addressed in this Critical Patch Update include: …………………
Click to expand...

Read here: http://www.securityweek.com/oracle-addresses-128-vulnerabilities-massive-critical-patch-update-cpu

Log in or Sign up

Oracle Addresses 128 Vulnerabilities in Massive Critical Patch Update (CPU)

snoopy Registered Members

Share This Page

Log in or Sign up

Oracle Addresses 128 Vulnerabilities in Massive Critical Patch Update (CPU)

snoopy Registered Members

Share This Page

Useful Searches