News Short

Oracle Updates Leave Serious Windows Vulnerability

April 18, 2007 — IDG News Service (San Francisco Bureau) — Some Oracle customers using the Windows operating system will have to wait another two weeks to receive a critical software update to their database software, thanks to a glitch that came up in testing the company's latest patches.

On Tuesday, Oracle unveiled its quarterly release of software patches, fixing not only database flaws, but also bugs in a host of other applications. In total, the patches fix 36 vulnerabilities, 13 of which relate directly to the database.

However, the most serious database flaw discussed in April's Critical Patch Update will not actually become available for users of the 9.2.0.8 version of Oracle's database until April 30, due to an issue that was uncovered in testing, said Darius Wiles, a manager with Oracle Security Alerts. The bug affects only the Windows platform and is patched on all other supported versions of the database, he added.

That flaw, known as DB01, is in the Core relational database management system (RDBMS) used by Oracle's database. It can be remotely exploited over the network, and unlike most of the database flaws, an attacker does not need to have authentication rights to the database to exploit the problem.

Wiles said it was the most critical flaw patched by Oracle this month. It is the only database flaw patched this quarter to be given the relatively severe 7.0 rating on the Common Vulnerability Scoring System. All other database patches scored a 3.4 or less.

One security expert said it looks like this flaw could be used to shut down or gain access to a database. In theory, it could even be exploited to run unauthorized software on the database server, said Alexander Kornbrust, a business director at Red-Database-Security. "I think people will now concentrate on this vulnerability," he said.

Also patched in this quarterly release are Oracle's Application Server, Collaboration Suite, E-Business Suite and Enterprise Manager, as well as the company's PeopleSoft and JD Edwards applications.

Oracle said that with its upcoming July 17 update, it will scale back the number of patches it releases for its server and middleware products. Starting next quarter, the company will not automatically produce patches for certain versions of its products on platforms that are rarely used. "Instead of systematically creating a Critical Patch Updates for those inactive combinations, we will only produce those patches if clients specifically request them," wrote Eric Maurice, a manager in Oracle's global technology business unit, in a blog posting.

Though these patches will not be shipped as part of the quarterly security updates, they will eventually make their way into Oracle's products through Oracle's other software update mechanisms, which update code less frequently than the Critical Patch process, a company spokeswoman said.