Oracle plans 46 security updates for database, software

Oracle plans to release 46 security updates to fix flaws attackers could exploit across its product line to tamper with database servers and host operating systems.

According to the Oracle's July 2007 Critical Patch Update pre-release announcement , database administrators (DBAs) can expect fixes for Oracle Database, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business Suite and Applications, and Oracle PeopleSoft Enterprise.

Oracle security: Podcast: The state of Oracle security:  Oracle DBA Jon Emmons gives his observations about Oracle's new critical patch update format. Podcast: Security360 - SOA, Web Services Security: ZapThink analyst Jason Bloomberg offers an overview of the security issues unique to SOA environments, while executives from SAP and Oracle discuss how they address SOA security. Oracle patches 36 holes: Oracle issued patches for 36 holes in the database management system, application server, E-Business Suite and JD Edwards and PeopleSoft software. Oracle releases 51 security fixes: The flaws are across Oracle's product line and attackers could exploit them remotely to compromise vulnerable systems. Oracle emulates Microsoft with advance patch notice: Oracle will patch 52 security flaws across its product line Tuesday, according to its inaugural CPU advance notification bulletin.

The database giant offered the following breakdown:

• Oracle Database is affected by 20 vulnerabilities including one in Application Express. Two of the flaws are remotely exploitable without authentication.

• Oracle Application Server is affected by four vulnerabilities, three of which are remotely exploitable without authentication.

• Oracle Collaboration Suite has one vulnerability that's remotely exploitable but requires authentication.

• Oracle E-Business Suite and Applications is affected by 14 vulnerabilities, six of which are remotely exploitable without authentication.

• Oracle PeopleSoft Enterprise PeopleTools is affected by three vulnerabilities, one of which is remotely exploitable without authentication. PeopleSoft Enterprise Customer Relationship Management is affected by two flaws, and PeopleSoft Enterprise Human Capital Management is affected by two flaws.

While details on the specific flaws have yet to be released, Cupertino, Calif.-based antivirus vendor Symantec Corp. offered customers of its DeepSight threat management service an emailed list of steps IT shops could take to reduce the risk of Oracle attacks until patches are deployed.

Steps include blocking external access at the network boundary unless external parties require service. "Configure network perimeter devices to block all access to ports and services that are not intended for public consumption," Symantec advised. "Permit access to only those services that are intended to be accessed by public users."

IT shops should also be sure to run all software as a non-privileged user with minimal access rights and implement multiple redundant layers of security, Symantec said.

"Deploy memory-protection schemes and host-based IPS on critical systems," the company added. "This tactic may complicate attempts to exploit latent vulnerabilities in protected applications and services."