Survey: Two-thirds of users don't deploy Oracle quarterly Critical Patch Update
153208
A survey of Oracle Users Group attendees finds two-thirds have never applied one of Oracle's quarterly Critical Patch Updates. Oracle, meanwhile, prepares to release its next quarterly CPU on Tuesday.
411451
Oracle Corp. released several high-risk vulnerabilities reported last month in its database software and other products, and urged customers to download and install them.
563347
No word on Word fixes, yet Microsoft issued seven patches on Tuesday - one more than expected - as part of its monthly Patch Tuesday update cycle. Three of the updates earn the dreaded rating of critical.â¦
218854
Company first released update last fall, but is issuing it again to stress to users that they could be at risk if they don't follow through.
581823
com December 14, 2004, 2:32 PM PT. Microsoft managed to give a small holiday gift to network administrators this month: No critical patches.
578566
InfoWorld - Just days after a security researcher blasted its Java patching system, Sun Microsystems has issued a critical update to the consumer version of its Java software.
143125
Weeks after coming under criticism for sitting on patches for multiple holes in its database software, Oracle Corp. has announced that it is moving to a monthly patch release schedule.
317024
Rob Richards mentioned in a previous book review about some of the issues he was having getting the Oracle extension enabled on his Fedora 8 system. Well, he's come back after doing some more testing/compiling and has found some resolution to his issues.   I really didn't need to get it running, but the sheer fact that I tried it and it wouldn't work, pissed me off enough to spend some time getting it resolved. Hopefully this helps anyone else having the same problem. I am currently using instant client 11.1, but I did try the 10.2 version with the same results.   He steps through the process he followed - tracking down the missing libaio files, correcting an issue with SELinux loading the Oracle libraries and his realization: he just needed to allow text relocation. Included in the post are the command line calls that'd need to be made to make it all happen.
757626
Nearly two-thirds of PeopleSoft customers &quot;not at all confident&quot; Oracle will integrate products, survey finds. Half of Oracle feel that way.
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
455894
Rolling update method deprives Java users of needed  patches, security vendor says.
297903
SAN FRANCISCO - Microsoft Corp. has pushed back automatic distribution of Windows XP Service Pack 2 (SP2) to allow business users more time to instruct their machines to skip the update.
563705
In surprising results, a survey finds that two-thirds of Oracle DBAs appear not to be installing Oracle's security patches.
636873
Patch management is a particularly expensive burden for Microsoft Windows-based systems. While solution providers have profited from the services associated with installing patches, many businesses are starting
702221
(InfoWorld) - The contentious stealth update that Microsoft delivered to customers this summer blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature, researchers said Thursday. Scott Dunn, who first reported the problem in a story posted Thursday morning to the "Windows Secrets" newsletter, said that users who reinstall Windows XP with the repair option cannot retrieve the full set of updates from Windows Update (WU). The problem, he said, has been traced to the so-called "stealth update" to WU which Microsoft has acknowledged sending to users beginning in July. Two weeks ago,Â Dunn broke the story of the background updates,Â which were sent to most non-corporate Windows XP and Vista users. The updates were delivered and installed without prior notification, even when the PC's owner had told the operating system not to download or install updates without notification and permission. The revelation launched a firestorm of protest from users, which in turnÂ prompted Microsoft to defend the practiceÂ as well as say it would think about ways to clarify its update policies. "Two weeks ago we said that the silent update was harmless," said Dunn Thursday. "But now we're saying it is a problem." That problem affects any user who restores Windows XP using the setup CD's "repair" option, sometimes also called an "in-place reinstallation" because it reinstalls the operating system files without disturbing the applications and data already on the disk drive. Because repair is essentially a roll-back to XP's original state, the OS must be updated with all subsequent patches and hotfixes using WU. A system bought soon after Windows XP SP2 was released, for example, would need to download and install about three years' worth of updates. After a repair, XP defaults to the "Automatic" setting for Automatic Updates, which means WU is immediately updated to version 7.0.600.381, the version pushed to PCs by the summer's undercover upgrade, said Dunn. Seven of the DLL (dynamic link library) files that make up 7.0.600.381, however, fail to register themselves with Windows. That, in turn, keeps XP from successfully installing approximately 80 of the most recent patches and fixes. In a normal, non-repair situation, there's no indication of a glitch, since DLLs by the same name have previously been keyed into Windows' registry. "On a repaired copy of XP, however, no such registration has occurred, and failing to register the new DLLs costs Windows Update the ability to install any patches," he said Dunn pointed out workarounds, which included installing an older version of WU over the top of 7.0.600.381. "Windows Secrets" has also posted instructions for creating a batch file that registers the seven DLLs. While the registration failure and the unsuccessful patch installations aren't directly related to the fact that Microsoft didn't disclose the silent WU updates, Dunn sees it as part of a bigger, and disturbing, picture. "It's part of the whole problem with the silent update, and all part of the pattern of Microsoft's sloppiness," he said. "They're keeping us out of the loop. They're not working well with the IT community." If anyone needed proof that stealth updates are a bad idea, Microsoft's defense of the practice notwithstanding, this is it, said Dunn. "IT needs to test updates for this very reason. It's why companies like to download and test updates before they install to the rest of the network," he said. It's not clear how long WU has prevented post-repair updates, but searches through Microsoft's support newsgroups revealed questions about similar behavior as long ago as June. Responses by other users, including some with Most Valued Professional (MVP) designation -- a honorific Microsoft gives to users who make major contributions to the Windows community -- offered advice much like Dunn's. Several of them pointed users to the support document KB916259. The earliest such postings, however, preceded the silent WU update to version 7.0.600.381. When questioned about the discrepancy, Dunn acknowledged the similarities, but in an e-mail said that the two issues were different. He cited several inconsistencies, including an error message called out in the support document that doesn't appear in his test machines. In fact, Microsoft has updated WU twice since late May: the July-August silent update and a visible update rolled out in June. That update was designed to fix aÂ long-standing problem with Automatic UpdatesÂ in which the PCs' CPUs maxed out at 100 percent. Microsoft was not available for comment early Thursday morning. ComputerworldÂ is an InfoWorld affiliate.
688308
Oracle plans to fix dozens of flaws in its software products next Tuesday, including critical bugs in the company&#39;s database, e-business suite, and application server.In its first security update of 2008, Oracle will ship 27 security fixes, some of which will affect several products. Oracle outlined some details of the upcoming patches in a pre-release announcement posted to the company&#39;s Web site Thursday afternoon.Oracle releases security patches every three months, a process known as the Critical Patch Update (CPU). January&#39;s bug-fix total is low by Oracle&#39;s standards. In October, the company&#160;patched 51 vulnerabilities.As usual, the company&#39;s database will be a major focus of the CPU. Oracle plans to ship eight security fixes for the Oracle Database, addressing bugs in the software&#39;s advanced queuing, core RDBMS (relational database management system), Oracle Agent, Oracle Spatial, and XML (Extensible Markup Language) database software.None of the database vulnerabilities can be exploited over a network without the attacker first obtaining a username and password for the database.Oracle&#39;s next most-patched product will be the E-Business Suite, which will receive seven updates, three of which are for bugs that can be remotely exploited by attackers who do not have usernames or passwords for the system.The Oracle Application Server will get six bug-fixes, addressing flaws in components such as the product&#39;s BPEL (Business Process Execution Language), Worklist Application, Oracle Forms, and Oracle Internet Directory software.Finally, Oracle is planning four updates for its PeopleSoft and JD Edwards products, as well as one fix each for Oracle Enterprise Manager and the Oracle Collaboration Suite.
460881
Fortunately, the risk to end users is low if system has been patched with Microsoft Updates.