Oracle fixes Struts and Shadow Brokers exploits in huge patch release

The quarterly Oracle patch update fixes almost 300 vulnerabilities

IDG

IDG

Oracle has released a record 299 security fixes for vulnerabilities in its products, including patches for a widely exploited vulnerability in the Apache Struts framework and a Solaris exploit supposedly used by the U.S. National Security Agency.

The Struts vulnerability allows for remote code execution on Java web servers and was patched on March 6. Attackers have quickly adopted it and have used it in widespread attacks since then.

Oracle uses Apache Struts 2 in several of its products, which is why Tuesday's critical patch update (CPU) fixed 25 instances of the vulnerability in Oracle Communications, Retail and Financial Services applications, as well as in the MySQL Enterprise Monitor, Oracle WebCenter Sites, Oracle WebLogic Server and the Siebel E-Billing app.

The company also fixed the vulnerability behind the EXTREMEPARR exploit for Solaris 10 that was leaked recently by a group called Shadow Brokers as part of a larger data dump of alleged NSA cyber tools. Another Solaris exploit that was part of the same arsenal and was dubbed EBBISLAND has been patched since 2012 in Solaris 10 Update 11, Oracle said.

Oracle's quarterly patch bundle contains fixes for 40 vulnerabilities that are rated as critical, 25 of which have the highest severity score of 10 in the Common Vulnerability Scoring System (CVSS). Overall, 162 out of the 299 patched vulnerabilities are remotely exploitable.

Oracle's applications for specific industry sectors -- financial services, retail, communications, utilities, hospitality, health sciences and insurance -- account for almost 40 percent of all security fixes this quarter, according to an analysis by security vendor ERPScan.

Oracle business-critical applications like Oracle PeopleSoft, E-Business Suite, JD Edwards, Siebel CRM and the Primavera Products Suite received 83 security fixes.

"Nowadays, hackers set their eyes on enterprises more than on individuals, as they understood that this option is more profitable," said Alexander Polyakov, CTO at ERPScan. "Taking into account that Oracle’s products are installed in the largest enterprises, these applications can be the ultimate target."

On the database side, Oracle patched 39 vulnerabilities in MySQL and 3 in its Oracle Database Server. Java also received 8 security fixes.

Triaging and deploying the patches that make up this Oracle CPU, the largest ever for the company, will be a lot of work for systems administrators. The size of Oracle's quarterly updates has steadily increased over the years, raising the question of whether a monthly update cycle instead of a quarterly one wouldn't be more appropriate.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?