[ISN] Oracle publishes out-of-cycle security fix

[InfoSec News]

http://www.networkworld.com/news/2006/022706-oracle-security-fix.html

By Robert McMillan
IDG News Service
2/27/06

Oracle has released a critical security patch to the company's
E-Business Suite software. The patch, which was released nearly two
months ahead of Oracle's next regularly scheduled security updates,
fixes a number of vulnerabilities in the Oracle Diagnostics
troubleshooting component of the company's E-Business Suite 11i.

Oracle executives could not immediately be reached for comment on the
update, but the company is advising customers to apply the patch "due
to the number of security fixes included," according to enterprise
software consulting firm Integrigy.

The problems relate to the Oracle Diagnostics Web pages and to the
Java classes included with the software, which could be
inappropriately used by an attacker. "The most significant issue with
the Oracle diagnostics is that some of the diagnostics can be executed
without any authentication," Integrigy said in an analysis of the
patch.

Though Oracle has been issuing its quarterly security updates for only
about a year now, it is "standard procedure" for the company to
include security fixes in out-of-cycle releases such as the
Diagnostics patch. It is, however, unprecedented for Oracle to inform
customers of such security fixes, Integrigy said.

Oracle probably took this step to speed up adoption of the patch, the
consulting firm said.

"My guess is that it's just serious enough that they really felt it
was necessary to release it early," said Johannes Ullrich, chief
technical officer of the SANS Internet Storm Center.

Oracle's next security update is scheduled for April 18.

Oracle customers can find more information about the patch (document
ID: 226429.1) on the Oracle MetaLink site.