Risk: High
101 flaws have been found in Oracle's database, application server, E-Business Suite and PeopleSoft and JD Edwards applications.
Although 22 of the 101 flaws require some form of identification in order for them to be exploited, 45 can be exploited by a hacker. At least six errors in the Oracle database http server can be exploited without the hacker needing to possess a user name or password.
Oracle's Senior Manager for Security Alerts, Darius Wiles, said: "In terms of critical fixes, the majority of them lie within the application server product. There is a number that could be exploited both remotely and without authentication, and those are the ones that customers should be most concerned about and fix as soon as possible."
Oracle's most recent critical security advisory is available at:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2006.html