Oracle has put out what has been described as a "huge" quarterly Critical Patch Update (CPU), with fixes for 78 vulnerabilities across hundreds of products.
It marks another big patch announcement, following the 66 vulnerability CPU in January.
The hefty update is largely down to Oracle's acquisition of significant companies like PeopleSoft and Sun Microsystems, as well as its own wide range of products, said Amol Sarwate, Vulnerability Labs manager for Qualys.
"Our top priority goes to patching vulnerabilities that attackers can remotely exploit without authentication and where the affected systems could be exposed to the outside world," Sarwate said.
"For Sun users this includes nine vulnerabilities that affect Solaris (CVE-2011-2287, CVE-2011-2245, CVE-2011-2294, CVE-2011-2298) SPARC (CVE-2011-2288, CVE-2011-2299, CVE-2011-2307) and Oracle GlassFish Server(CVE-2011-1511, CVE-2011-2260). Protocols that attackers could use for exploitation include SSH, HTTP, SSL and KSSL."
The next priority for IT managers should be to look at vulnerabilities which could be remotely exploitable but affect products which typically would not be exposed due to network segregation or firewalls, Sarwate said.
This includes patches for Oracle Database Server, Grid Control, Enterprise Manager and PeopleSoft.
"While some of the products may have a legitimate business reason to be exposed outside of the corporate network, we strongly advise organisations to access their network infrastructures and prioritise patches based on their exposure," Sarwate added.
"The CPUs are becoming huge. But due to the diversity of affected products, our guess is that many larger organisations could have specialised teams working on different products in order to make the Oracle quarterly CPU a bit more manageable."
The next Oracle CPU is due for 18 October, which will be the last of 2011. Another will be issued on 17 January.
Head here for Oracle's CPU announcement and breakdown of affected vulnerabilities.
-
Should AI PCs be part of your next hardware refresh?AI PCs are fast becoming a business staple and a surefire way to future-proof your business
-
Westcon-Comstor and Vectra AI launch brace of new channel initiativesNews Westcon-Comstor and Vectra AI have announced the launch of two new channel growth initiatives focused on the managed security service provider (MSSP) space and AWS Marketplace.
-
Organizations shift away from Oracle Java as pricing changes biteNews A survey from Azul Systems finds that, along with cost, customers cite a preference for open source and the threat of a Java usage audit
-
Why Java 17 growth is ‘exploding’News Java 17 is now the most popular LTS version, according to application data from New Relic, but what's driving this growth?
-
SuiteWorld 2023: NetSuite's day-two announcementsLive Blog Keep up-to-date with all the day-two announcements from NetSuite SuiteWorld 2023
-
Microsoft defends “negligent” security approach that prolonged vulnerability fix for five monthsNews The tech giant has refuted claims that its practices have left customers “in the dark”
-
Ubuntu shifts to four-week update cycleNews Critical fixes will also come every two weeks, mitigating the issues involved with releasing prompt patches on the old three-week cadence
-
Can Oracle really be Linux's knight in shining armor?Opinion The self-proclaimed champion of open source freedom would like you to forget about its history
-
Microsoft angers admins as April Patch Tuesday delivers password feature without migration guidanceNews Security fixes include a zero day exploited by a ransomware group and seven critical flaws
-
Oracle’s Java subscription changes spark concerns over cost hikes for smaller businessesNews Smaller businesses could incur significant cost hikes as high as 1,400% with most new customers expected to pay at least double
