Risk: High
The product flaws vary in terms of exploitability. Oracle Database has 12 flaws, including a flaw in Database 10g's Oracle OLAP (online analytical processing) that requires Database privilege 'execute on olapsys' but which, according to Oracle's posting, is both easily accessible and would have a wide impact.
Oracle's Application Server also has a dozen flaws that span the range in terms of authorization required, severity of impact and ease of exploitation. Collaboration Suite has six flaws and E-Business Suite has 17, while Enterprise Manager has two.
The new database vulnerabilities addressed by this Critical Patch Update don't affect Oracle Database Client-only installations (installations that don't have the Oracle Database Server installed).
Therefore, according to Oracle's posting, it is not necessary to apply this Critical Patch Update to client-only installations if a prior Critical Patch Update, or Alert 68, has already been applied to the client-only installations.
The Oracle Database Server, Enterprise Manager and Oracle Application Server patches are cumulative, containing all fixes from the previous Critical Patch Update.
Not so for E-Business Suite or Collaboration Suite patches, however, so customers using these products should refer to previous Critical Patch Updates to identify previous fixes they need to apply.
This is the third of Oracle's Critical Patch Updates since the company started cumulative patch releases in January.
Despite this hefty update, a German database security outfit went public in mid-July with information on six unpatched vulnerabilities; some rated critical, in Oracle Forms and Oracle Reports, two widely deployed enterprise-facing products.
Red-Database-Security GmbH, a company that specializes in Oracle security audits, warned that the most serious flaw could allow a malicious hacker to use a Web browser to overwrite any file on a vulnerable application server.
Alexander Kornbrust, founder and CEO of Red-Database-Security, said three of the flaws are deemed "critical" because of the high risk they present to businesses using the affected products.
In an interview with Ziff Davis Internet News, Kornbrust said he decided to publicly release the information after waiting more than 700 days for Oracle to address the issues.
The advisories from Red-Database-Security GmbH could be found here: http://www.red-database-security.com/advisory/published_alerts.html