Oracle to ship critical security patches next week
688308
Oracle plans to fix dozens of flaws in its software products next Tuesday, including critical bugs in the company&#39;s database, e-business suite, and application server.In its first security update of 2008, Oracle will ship 27 security fixes, some of which will affect several products. Oracle outlined some details of the upcoming patches in a pre-release announcement posted to the company&#39;s Web site Thursday afternoon.Oracle releases security patches every three months, a process known as the Critical Patch Update (CPU). January&#39;s bug-fix total is low by Oracle&#39;s standards. In October, the company&#160;patched 51 vulnerabilities.As usual, the company&#39;s database will be a major focus of the CPU. Oracle plans to ship eight security fixes for the Oracle Database, addressing bugs in the software&#39;s advanced queuing, core RDBMS (relational database management system), Oracle Agent, Oracle Spatial, and XML (Extensible Markup Language) database software.None of the database vulnerabilities can be exploited over a network without the attacker first obtaining a username and password for the database.Oracle&#39;s next most-patched product will be the E-Business Suite, which will receive seven updates, three of which are for bugs that can be remotely exploited by attackers who do not have usernames or passwords for the system.The Oracle Application Server will get six bug-fixes, addressing flaws in components such as the product&#39;s BPEL (Business Process Execution Language), Worklist Application, Oracle Forms, and Oracle Internet Directory software.Finally, Oracle is planning four updates for its PeopleSoft and JD Edwards products, as well as one fix each for Oracle Enterprise Manager and the Oracle Collaboration Suite.
171911
REDWOOD SHORES, CALIFORNIA - Oracle Corp. plans to finally ship the next version of its E-Business Suite of enterprise applications on Monday Nov. 8, company executives said Thursday.
634378
InfoWorld - The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.
446418
(InfoWorld) - Oracle Corp. has always made bold claims about the security of its database and applications. Now the company has said it will make security a priority as it begins rolling out its next-generation software products for building service-oriented architectures (SOAs), Oracle Fusion, in the next several years. Speaking at an event in New York on Wednesday, Oracle President Charles Phillips outlined three areas of security that will be important to Oracle going forward -- access control, data privacy and compliance. Acquisitions and internal product development over the last 18 months have given Oracle a comprehensive portfolio in this area, allowing the company to think of security "holistically" across its product line, he said. "We take it pretty seriously," Phillips said. "We [are putting] security where it belongs, which is consistent across the architecture." Oracle has had its ups and downs when it comes to security. The company is infamous for a 2002 marketing campaign in which it called its database "unbreakable," a notion that was proven wrong by security researchers. While Oracle's database has not been the target of a widespread attack, security experts point out that it is also in a less vulnerable position than many commonly targeted programs. Oracle databases are embedded so deeply in a network's infrastructure that attacks aimed for it are thwarted by technologies closer to the surface, such as firewalls. The true test of Oracle's security will come when it begins opening up its products to allow for SOAs, which enable applications to communicate via Web services standards across disparate systems. "Adding Web services to an architecture makes everything often more insecure because you add an additional way into the database," said Alexander Kornbrust, chief executive officer of security consulting firm Red Database Security GmbH. "Web services should be designed and developed very carefully." Beginning in March 2005, Oracle began a string of purchases to bolster its security portfolio. In March the company purchased Oblix, which has access-management software. Then last November, Oracle acquired Thor Technologies for identity provisioning and compliance software and Octet String for identity virtualization software. The company is combining these acquired technologies with new software it developed internally: Database Vault, which prevents the database administrator from accessing sensitive information stored in an Oracle database, and Audit Vault, a data warehousing product to keep track of data stored in various places. The former is available now, while Audit Vault will be available in the next few months, said Thomas Kurian, senior vice president of server technology for Oracle. Together with existing products such as Oracle Identity Federation, the products help shore up a strong portfolio for protecting data across multiple applications and systems in the network, he said. Oracle has these products now, but they will become increasingly important as SOAs become more prevalent and Oracle rolls out its Fusion architecture over the next couple of years, Kurian said. "We'll be making sure at each level of the application, you have common policies that are enforced," he said. "No matter where you come in [on a network], you can still access security." Charles Kolodgy, an IDC security analyst, called Oracle's presentation on Wednesday "a little underwhelming," but said the message the company was trying to send is important. "Many of their customers are not aware that Oracle has security offerings to help customers manage identity, data protection and compliance," Kolodgy said. "They have been know for building security into their products, but not for building security products." However, despite the rosy picture Oracle paints about its past and future security strategy, it's something customers have traditionally been less than happy with, Kornbrust said. New products like Data Vault and Oracle Transparent Data Encryption -- which encrypts database data and stores the encryption keys in another location -- show the company is taking security more seriously, he said. But Oracle has a long way to go before it gets it right. "They are not doing enough helping customers to make their database secure," Kornbrust said. "The patches are still ugly ... Selling new -- and expensive -- high-end features is good but doesn't raise the bar for the normal Oracle security. Most databases I see are vulnerable in most cases." Still, said Kornbrust -- whose firm handles Oracle security exclusively -- those responsible for securing Oracle infrastructure "appreciate the direction Oracle is taking in the last month." However, it will take at least two to four years for most database administrators and developers to see results of the changes taking place now, he said.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
650104
Oracle is expected to unveil updates to its software's content management and business intelligence functions, as well as other enhancements at next week's Oracle OpenWorld user event.
628805
After just two security updates in January, Microsoft plans to release one of its largest bundles of patches ever next Tuesday.
310326
Business software maker Oracle Corp.  on Friday said it had decided to move forward the release date of its fiscal second-quarter earnings to Monday, Dec. 13 before markets open instead of Thursday, Dec. 16.
738931
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft today offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
159928
As part of its new advance warning policy, Microsoft on Thursday said next week&#39;s regularly-scheduled patch day will feature five fixes for Windows, none of them more severe than &quot;Important.
513312
Microsoft plans to issue two security updates for its Windows operating system products next Tuesday as part of its regular software patch cycle.The updates were pre-announced Thursday morning on Microsoft&#39;s Web site in order to give IT staffers a sense of how busy they will be next week installing the patches.One of the updates is considered critical for Windows Vista and XP users because the flaw it fixes could be used by attackers to install unauthorized software on a victim&#39;s computer. This update is rated important for Windows Server 2003 users and considered moderate for Windows 2000 users.The second update, rated important for all Windows users, could allow an attacker to run software with a higher level of privilege on a system than would normally be allowed.Microsoft did not provide any technical details on the updates.With just two updates scheduled, January will be a light month by Microsoft&#39;s standards. In 2007 the company shipped 69 software updates, an average of just under six per month.
12873
Oracle is warning customers to apply software patches it released in August because of the availability of malicious code that can exploit unpatched vulnerabilities in its software.
246105
Oracle plans tomorrow to introduce Oracle Application Server 10g Release 2, a significant upgrade with improvements in Java, Web services and identity management, as well as support for RFID technology.
274982
Forty-five fixes out. One missing in action Oracle released 45 security patches on Tuesday as part of its latest quarterly patch update, one less than expected.â¦
45578
Oracle  will release 46 patches on Tuesday for products including its Oracle Database 10g, Application Server and E-Business Suite.
39329
Microsoft will issue six security patches next Tuesday, of which at least two will have a rating of critical. Missing from this list is a patch for a recently discovered zero-day flaw in Word: no updates are scheduled for the Office suite.
617407
Oracle Corp. will release 46 patches on Tuesday for products including its Oracle Database 10g, Application Server and E-Business Suite.
17527
The US government&#39;s Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.