Oracle to patch 59 DB server holes

Oracle has announced plans to patch 59 new security vulnerabilities across hundreds of product lines, including the newly acquired Solaris product suite.

The patches, due today (July 13, 2010), will address flaws that could lead to malicious hacker attacks without requiring user authentication.

From Oracle's pre-announcement:

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. This Critical Patch Update contains 59 new security vulnerability fixes across hundreds of Oracle products. 21 out of 59 vulnerabilities are in Solaris product suite. Some of the vulnerabilities addressed in this Critical Patch Update affect multiple products.  Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.

Here's a breakdown of the affected Oracle products:

Oracle Database: This Critical Patch Update contains 13 new Security fixes for the Oracle Database Server divided as follows:

• 6 new security fixes for the Oracle Database Server.  4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.  1 of these fixes is applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The highest CVSS Base Score of vulnerabilities affecting Oracle Database products is 7.8.
• 2 new security fixes for the TimesTen In-Memory Database.  Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The highest CVSS Base Score of vulnerabilities affecting TimesTen In-Memory Database is 10.0.
• 5 new security fixes for Oracle Secure Backup.  3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The highest CVSS Base Score of vulnerabilities affecting Oracle Secure Backup is 10.0.

Oracle Fusion Middleware: This Critical Patch Update contains 7 new security fixes for Oracle Fusion Middleware.  5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

The highest CVSS Base Score of vulnerabilities affecting Oracle Application Server products is 7.5.

Oracle Enterprise Manager Grid Control: This Critical Patch Update contains 1 new security fix for Oracle Enterprise Manager.  This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.  This fix is not applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed. The CVSS Base Score of vulnerability affecting Oracle Enterprise Manager Suite product is 4.3.

Oracle Applications: This Critical Patch Update contains 16 new Security fixes for the Oracle Applications divided as follows:

• 7 new security fixes for the Oracle E-Business Suite.  5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The highest CVSS Base Score of vulnerabilities affecting E-Business Suite products is 7.5.
• 2 new security fixes for the Oracle Supply Chain Products Suite.  1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. The highest CVSS Base Score of vulnerabilities affecting Oracle Supply Chain products is 4.3.
• 8 new security fixes for the Oracle PeopleSoft and JDEdwards Suite.  None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without the need for a username and password. The highest CVSS Base Score of vulnerabilities affecting Oracle PeopleSoft and JDEdwards products is 5.5.

Oracle Solaris Products Suite: This Critical Patch Update contains 21 new security fixes for the Oracle Solaris Products Suite.  7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

The highest CVSS Base Score of vulnerabilities affecting Oracle Solaris Products Suite is 7.6.