Oracle Details Over 100 New Flaws

Posted in Operating Systems and Application Security, Security by Dragan Pleskonjic @ Oct 21, 2006

Oracle users have been complaining for some time that they get too little information, but that changed this week with Oracle’s final quarterly Critical Patch Update (CPU) of 2006, which fixes more than 100 flaws.

The October update represents the largest number of flaw fixes in all of 2006.

The last update in July had 65 bugs, April’s update had 36 and January’s update fixed 82 flaws.

Of the 101 security fixes in the October update, 56 could potentially be remotely exploited without even a username or password. Oracle had not previously disclosed in its CPUs how many flaws were remotely exploitable.

“While existing CPU risk matrices made it possible to assess whether a specific vulnerability was remotely exploitable without requiring authentication on the targeted system, Oracle is now going to specifically identify this type of vulnerability,” Eric Maurice Manager for Security in Oracle’s Global Technology Business Unit wrote on Oracle’s security blog.