Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Oracle Patches (Jan2011 CPU) - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Oracle Patches (Jan2011 CPU)

Today, Oracle will release its quarterly patch bundle ("Jan2011 CPU").  The pre-announcement is already out, and it promises quite some "entertainment" for DBAs and Middleware Admins for the next couple weeks.  One thing that certainly stands out from the list is the vulnerability in Oracle Audit Vault with a CVSS score of 10.0, apparently remotely exploitable without authentication.  Always disappointing when a so-called security component makes the system actually more vulnerable.

We'll update this diary later, once the full information becomes available.



385 Posts
ISC Handler
Jan 18th 2011
Not to be overlooked are the listing of PeopleSoft; OpenOffice Suite; and Sun Java Suites with highest CVSS ratings of 5.5; 9.3; and 10.0 respectively.

January 19, 2011
"... This update contains the following security fixes:
7 for Oracle Database Server
16 for Oracle Fusion Middleware
2 for Oracle Enterprise Manager Grid Control
16 for Oracle Applications
3 for Oracle Supply Chain Products Suite
11 for Oracle PeopleSoft and JDEdwards Suite
2 for Oracle Industry Applications
23 for Oracle Sun Products Suite
2 for Oracle Open Office Suite ..."

160 Posts

Sign Up for Free or Log In to start participating in the conversation!