Quantcast
Subscribe to magazine

Oracle Patches Its Security Patches

Database patches fix flaws found in previous fixes.

Matthew Broersma, Techworld.com

  • 0 Yes
  • 0 No

Oracle has released two sets of database patches to fix flaws in previously released security patches. One of the affected fixes is itself a fix to an earlier set of patches. So that's a patch for a patch for a patch.

Separately, a serious security flaw has surfaced in MySQL, the popular open-source database management system, potentially allowing remote attackers to take over a system.

Oracle said last week that it has identified problems with two of its security updates. The first relates to a Critical Patch Update in April, which fixed 70 security flaws in Oracle databases and application servers. Earlier this month, Oracle confirmed that the April Critical Patch Update was flawed--a step was missing from the installation script. Last week, however, Oracle confirmed in an e-mail to customers that the July fix for the April update didn't work properly.

Oracle also issued another quarterly Critical Patch Update in July; this update fixes the problems with the April update. However, the July update has problems of its own, causing problems with Oracle Database 10.1.0.3 and 10.1.0.4 and Oracle Enterprise Manager, Oracle said in a customer e-mail last week. Customers running the affected versions of the database with Enterprise Manager should download an updated version, according to the company.

Under Fire

Oracle has come under heavy criticism for its patching system in recent months. Most recently a German security firm released details of several high-risk Oracle flaws, along with work-arounds, claiming to have seen no action from Oracle two years after reporting the bugs. The firm said the delay was more evidence that Oracle's patching system is in disarray.

Meanwhile, MySQL is vulnerable to a flaw involving the zlib compression library, according to an advisory from the database maker. MySQL contains a version of zlib that is vulnerable to a buffer overflow that could be exploited via a specially crafted compressed stream embedded in network communications or an application file format, according to researchers.

MySQL released an update, version 4.1.13, that fixes the problem, along with some less serious problems that could allow attackers to crash the server in various ways.

  • Recommend this story?
  • 0 Yes
    0 No

"Oracle Patches Its Security Patches" Comments

Print 65% more pages than with refilled inks. Trust Original HP Inks. Hit Print Reliably.

Featured APC Accessories For Your System
10% Off Entire Cart at Online Store

  • APC Back-UPS ES Safeguards your equipment from damaging surges and spikes that travel along your utility & data lines.
  • APC SurgeArrest Performance Highest level of protection for your professional computers, electronics and connected devices, as well as provides surge protection.

People who read this also read:

  • 2007 Microsoft Office Suites Comparison This paper compares and contrasts four suites of the 2007 Microsoft Office system: Microsoft Office Standard 2007, Microsoft Office Professional Plus 2007, Microsoft Office Enterprise 2007 and Microsoft Office Ultimate 2007. This paper is intended to help organizations understand the applications and capabilities offered, and to identify the suite that best fits their needs.
  • Windows Vista Migration: The Business Proposition It's not so much a matter of "if" but "when" for most organizations regarding migration to Windows Vista. Laying the groundwork now for this migration can yield higher ROI than waiting until later. This Computerworld Technology Briefing explains it all.

PC World's Marketplace