• United States



Managing Editor

Oracle Publishes Out-of-Cycle Security Fix

Feb 28, 20062 mins
CSO and CISOData and Information Security

Oracle Corp. has released a critical security patch to the company’s E-Business Suite software. The patch, which was released nearly two months ahead of Oracle’s next regularly scheduled security updates, fixes a number of vulnerabilities in the Oracle Diagnostics troubleshooting component of the company’s E-Business Suite 11i.

Oracle executives could not immediately be reached for comment on the update, but the company is advising customers to apply the patch “due to the number of security fixes included,” according to enterprise software consulting firm Integrigy Corp.

The problems relate to the Oracle Diagnostics Web pages and to the Java classes included with the software, which could be inappropriately used by an attacker. “The most significant issue with the Oracle diagnostics is that some of the diagnostics can be executed without any authentication,” Integrigy said in an analysis of the patch.

Though Oracle has been issuing its quarterly security updates for only about a year now, it is “standard procedure” for the company to include security fixes in out-of-cycle releases such as the Diagnostics patch. It is, however, unprecedented for Oracle to inform customers of such security fixes, Integrigy said.

Oracle probably took this step to speed up adoption of the patch, the consulting firm said.

“My guess is that it’s just serious enough that they really felt it was necessary to release it early,” said Johannes Ullrich, chief technical officer of the SANS Internet Storm Center.

Oracle’s next security update is scheduled for April 18.

Oracle customers can find more information about the patch (document ID: 226429.1) on the Oracle MetaLink site.

Keep checking in at our CSO Security Feed page for updated news coverage.

-Robert McMillan, IDG News Service

Managing Editor

Al Sacco was a journalist, blogger and editor who covers the fast-paced mobile beat for and IDG Enterprise, with a focus on wearable tech, smartphones and tablet PCs. Al managed writers and contributors, covered news, and shared insightful expert analysis of key industry happenings. He also wrote a wide variety of tutorials and how-tos to help readers get the most out of their gadgets, and regularly offered up recommendations on software for a number of mobile platforms. Al resides in Boston and is a passionate reader, traveler, beer lover, film buff and Red Sox fan.

More from this author