By Erika Morphy CRM Buyer Part of the ECT News Network
04/12/07 2:18 PM PT
The remotely executable flaws addressed in Oracle's upcoming security update could allow an attacker to extract confidential data, to change data or even to gain control of an application or the system it is running on, said Monty Ijzerman, threat research lead of McAfee Avert Labs.
eMarketer Whitepaper: Optimizing the E-Commerce Experience
From the Web to the Contact Center, are you prepared to proactively engage and keep your savvy customers? Read how e-commerce leaders are optimizing their sites with ratings, reviews, live help, Web analytics, mobile and more.
Oracle (Nasdaq: ORCL) will be releasing a Critical Patch Update next Tuesday that will remedy 37 vulnerabilities across several product lines, including 13 in the Oracle Database and five in the Application Server.
Some of the vulnerabilities are part of Oracle's family of acquired products. For instance, this update includes two new security fixes for Oracle PeopleSoft Enterprise PeopleTools, one fix for PeopleSoft Enterprise Human Capital Management and one for JD Edwards EnterpriseOne and JD Edwards OneWorld Tools.
In addition, there are 11 new security fixes for the Oracle E-Business Suite, two of which may be remotely exploited without authentication.
Components of Oracle's Life Sciences Applications also should be patched, the company said.
Patchy History
Of the 37 bugs, seven are serious and may be remotely exploitable without authentication, according to Oracle's prerelease advisory.
However, compared to earlier patch releases, this one suggests that Oracle's security vulnerabilities may be declining, Paul Henry, vice president of technology evangelism at Secure Computing, told CRM Buyer.
"In October, they issued a patch for 101 vulnerabilities," he noted.
Targeting Databases
That said, the remotely executable flaws addressed in this particular update are serious bugs that definitely needed patching, Henry said.
Such an unpatched vulnerability could allow an attacker to extract confidential data, to change data, or even to gain control of an application or the system it is running on, Monty Ijzerman, threat research lead of McAfee Avert Labs, told CRM Buyer.
"Exactly what the attacker's possibilities are might be more clear after Oracle's patch release next week and the releases of the corresponding advisories by independent database researchers," he said.
These flaws are particularly troublesome because Oracle databases tend to be exposed to the Internet, giving hackers an open path the network, Roger Thompson, chief technology officer for Exploit Prevention Labs, told CRM Buyer.
"Some of the vulnerabilities could be used to perform SQL injections that can affect the data in a Web site," he explained. "The site then becomes an an unwitting and innocent lure for hackers."
The update covers vulnerabilities in the following Oracle products:
Salesforce.com Pushes Into Content Management With Acquisition April 11, 2007
The fact that Salesforce.com introduced its own application along with an extended platform for partners might introduce a new note of uncertainty into its partner relations. "If Salesforce.com continues to move into areas that are not its core competency, that could make the partner ecosystem more tenuous," said Martin Schneider, an analyst with the 451 Group.
Related Stories
Oracle Application Express 3.0 Touts Access Migration March 26, 2007
Oracle on Monday announced the availability of its Web-based application development tool, Oracle Application Express. The database software giant added a host of new features, including enhanced PDF printing functions, a Flash-based charting engine, improved reporting capabilities and Web services, and drag-and-drop application design.
Oracle Sues SAP for Spying March 23, 2007
SAP employees posed as Oracle customers in order to steal software and technical documents from the company's customer support Web site, a new lawsuit alleges. Oracle claims SAP conducted the raid in order to build a migration package to lure waffling PeopleSoft and Siebel customers from Oracle to SAP.
Related News Alerts
More by Erika Morphy
Ballmer Gives Shareholders - and Dell - Cause for Optimism November 20, 2009
Microsoft CEO Steve Ballmer was all smiles at the company's shareholders meeting, as he touted the early success of Windows 7. Ballmer's cheer may have been contagious; after posting a massive earnings decline for the third quarter, Dell needed some good news to latch onto, and the prospect of broad enterprise adoption of Windows 7 could spur PC sales.
AA.com Sucks the Fun Out of Trip-Planning November 20, 2009
Using AA.com to book a flight was a painful experience. Densely packed, disorganized information was displayed in an unattractive format. On the plus side, it did seem as though the deals American Airlines advertised were real and not mere bait-and-switch lures. For anyone who wants a travel-planning Web site to inject a little pleasure into the experience, though, I say look elsewhere.
Salesforce.com Pumps Up Volume of Workplace Chatter November 19, 2009
Salesforce.com has developed a collaboration platform that puts social networking to work. Salesforce Chatter facilitates employee collaboration on projects through Facebook-like profiles, status updates, feeds and groups. The question remains whether employees will be as open to social networking in the workplace as they are in their personal lives.
Headline Feeds
Talkback: 
