Go to:

IT Jobs

Oracle customers who use Windows are to be forced to wait for a fortnight to receive a critical software update. That's thanks to a glitch that came up in testing the company's latest patches.

According to Darius Wiles, a manager with Oracle Security Alerts, the update for the 9.2.0.8 version of Oracle's database will not become available until 30 April, even though the company unveiled its quarterly release of software patches on Tuesday.

The flaw, known as DB01, is in the Core RDBMS used by Oracle's database. It can be remotely exploited over the network and unlike most of the database flaws, an attacker does not need to have authentication rights to the database to exploit the problem.

Wiles said it was the most critical flaw patched by Oracle this month. It is the only database flaw patched this quarter to be given the relatively severe 7.0 rating on the Common Vulnerability Scoring System. All other database patches scored a 3.4 or less.

One security expert says that it looks like this flaw could be used to shut down or gain access to a database. In theory, it could even be exploited to run unauthorised software on the database server, said Alexander Kornbrust, a business director at Red-Database-Security. "I think people will now concentrate on this vulnerability," he said.

Also patched in this quarterly release are Oracle's Application Server, Collaboration Suite, E-Business Suite, and Enterprise Manager, as well as the company's PeopleSoft and JD Edwards applications.

Oracle said that with its upcoming 17 July update it will scale back the number of patches it releases for its server and middleware products. Starting next quarter, the company will not automatically produce patches for certain versions of its products on platforms that are rarely used. "Instead of systematically creating Critical Patch Updates for those inactive combinations, we will only produce those patches if clients specifically request them," wrote Eric Maurice, a manager in Oracle's Global Technology Business Unit, on the Oracle security blog.

Though these patches will not be shipped as part of the quarterly security updates, they will eventually make their way into Oracle's products through Oracle's other software update mechanisms, which update code less frequently than the Critical Patch process, a company spokeswoman said.

The change will streamline Oracle's testing process, which tests updates for dozens of software products running on about 20 operating system platforms.

Oracle did not say which platform and product combinations it considers "inactive." A list of this software will be made public before the next Critical Patch Update in July, the spokeswoman said.