Some patch updates are larger than others, a lot larger. Such is the case with Oracle’s July Critical Patch Update, which tackles a whopping 276 vulnerabilities across multiple Oracle software products.
Oracle has had a quarterly patch cycle for its software portfolio since 2004, and as new companies have been acquired, including Sun Microsystems in 2010, the list of software has expanded. Yet during the 12 years of Oracle software updates, there have never been as many vulnerabilities patched as there are now in the July 2016 update.
In April 2006, Oracle’s CPU patched a meager 36 vulnerabilities, while the most recent patch update in April 2016 fixed 136 flaws.
So far in 2016, the patched vulnerability count has gone up significantly, with 248 in January and 276 in July, Sarwate said.
Not all of the vulnerabilities that Oracle patched are equally severe, and the most serious are typically those identified as being remotely exploitable without authentication. For the July update, 159 vulnerabilities can be exploited remotely by a potential attacker, without the use of a username or password.
Regarding specific software applications that are being patched, Oracle’s Fusion middleware tops the list with the most issues, at 40 vulnerabilities, 35 of which are remotely exploitable without authentication.
Software from Oracle’s Sun Systems portfolio is being patched for 34 different vulnerabilities, 21 of which are remotely exploitable without authentication.
Oracle has invested in improving Java over the last few years; back in 2014, Cisco identified Java as the primary cause of 91 percent of all attacks. In 2015, improvements Oracle made to Java significantly reduced the risks. In December 2015, Oracle settled with the U.S. Federal Trade Commission over charges related to Java software updates and security.
The MySQL database server, in contrast to Java, has only three issues that are remotely exploitable without authentication, out of a total of 22 security vulnerabilities. Oracle’s namesake database is also being patched, but only five of the nine vulnerabilities that are patched can be remotely exploited by an attacker without authentication.
“Most components affected in today’s update were the usual suspect, so no surprise there,” Sarwate said. “In my opinion, the massive size of the update itself was a surprise, and going forward, I think 200-plus vulnerability fixes is going to be the norm.”]
Originally published on eWeek
Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector
Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…
Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…
Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…
Explore the future of work with the Silicon In Focus Podcast. Discover how AI is…
Executive hits out at the DoJ's “staggering proposal” to force Google to sell off its…