Oracle Critical Patch Update October

Published: 2012-10-17
Last Updated: 2012-10-17 03:19:56 UTC
by Mark Hofman (Version: 1)
2 comment(s)

Oracle has just released their critical patch update

Quite  a number of products are being patched also for those of you subject to PCI DSS there are a significant number of patches addressing issues with a CVSS score of 4 or higher, which must be patched under the standard.

They have also released a critical patch update for Java 

The info in the Oracle bulletin is comprehensive and should allow you to identify what needs to be done fairly easily.  Both bulletins have the following wording in the work around section "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible." For most of us not new (at least not on the java side), but maybe a strong argument if you get pushback on patching.

Happy patching, as always test before you implement.

Mark H - shearwater

2 comment(s)


I reported CVE-2012-3152 and CVE-2012-3153 to Oracle back in March and they just released a fix but from what I understand, they are only fixing future versions and not older ones. They said they would inform customers how to patch but I haven't seen any details.

The two vulnerabilities are trivial to exploit, one which allows you to use a web browser to grab files off of the system that the oracle account has access to. The other allows you to grab database passwords. All unauthenticated.

If you run Oracle Reports Servers it might be a good idea to make sure diagnostic output is disabled. That will mitigate the vulnerability.
Not seeing much news about this in the normal places (US-CERT, etc.), but this cycle also included 30 Java security holes.

I was first tipped off by this story:

Diary Archives