The July 2010 Oracle Critical Patch Update (CPU) contains 59 new security fixes across all of Oracle's product families, including 21 new fixes affecting Oracle Sun products. Former Sun technologies patched in this update are Solaris/OpenSolaris, Sun Java System Web Proxy Server, Sun Convergence, Access Manager/OpenSSO, Solaris Studio, and Sun GlassFish Enterprise Server/Sun Java System Application Server. According to Oracle, seven of these 21 vulnerabilities may be remotely exploitable without authentication, meaning they may be exploited over a network without the need for a username and password.

The Critical Patch Update is the primary mechanism Oracle will be using to communicate the release of security fixes for the Sun product lines. An out-of-cycle Security Alert could be issued in case of a unique or dangerous threat for Sun products. In this event, customers will be notified of the Security Alert by email notification through My Oracle Support and Oracle Technology Network (OTN). Users should also note that fixes coming in Security Alerts will be included in the next Critical Patch Update. Oracle provides Critical Patch Updates or CPUs every quarter to fix security vulnerabilities. The next Oracle CPU advisory is expected to be published October 2010.

Sun users just being introduced to the Oracle Software Security Assurance policies and procedures may want to read through a short document on OTN, which highlights changes made by Oracle to the security vulnerability handling policies for the Sun product line.

Anyone interested in providing feedback regarding Oracle's security patching procedures is encouraged to join in a new security assurance survey being conducted by Oracle and the Independent Oracle User Group (IOUG). Eric Maurice, writing for The Oracle Global Product Security Blog, says the purpose of this survey is to gather feedback from as many organizations as possible about their security patching practices and to identify which security assurance topics are most relevant to Oracle customers. Survey responses will be kept confidential, and the results will be analyzed jointly by Oracle and IOUG to evaluate Oracle's security assurance practices. The survey is hosted by IOUG's Enterprise Best Practices Special Interest Group (SIG). Free SIG membership is required to access the survey.

Besides the Oracle Sun products, new security fixes in Oracle's July 2010 CPU have been issued for:

• Oracle Database Server, including Oracle Secure Backup and Oracle TimesTen In-Memory Database;
• Oracle Fusion Middleware, including WebLogic products;
• Oracle Enterprise Manager;
• Oracle E-Business Suite;
• Oracle Supply Chain Products Suite; and
• Oracle PeopleSoft Enterprise.

More Information

July 2010 Oracle Critical Patch Update (CPU)

Changes in security policies for the Sun product lines

Critical Patch Updates and Security Alerts [...read more...]

		fullsource
Print Email Current Profile Archive Blog Generate newsletter

Other articles in the Security section of Volume 149, Issue 3: July 2010 Critical Patch Update Released (this article) See all archived articles in the Security section.

Top 10 Most Popular Articles in Current Issue (Vol 167, Issue 4) Simplified Administration with ZFS Documentation for Common Sysadmin Tasks Solaris 10 OS and ZFS Cut Costs, Boost Uptime as Alternative to RAID Oracle Certified Associate (OCA), Oracle Solaris 11 System Administrator MySQL: An Introduction for Oracle DBAs illumos Meetup at FOSDEM Linux Adoption Trends 2012: A Survey of Enterprise End Users MySQL 5.0 and 5.1 available on Solaris 11 World Record x86 TPC-C Result Java Spotlight Episode 65: Deployment & Plugin Recent Blog Entries as of February 4, 2012, 11:33 am Oracle Enterprise Manager Enables Cerner Health Care to Cut Capital Expenditures by $9.5 Million Beefing Up Xeon Reliability, Availability, and Serviceability: Slide Set Java Spotlight Episode 54: Stuart Marks on the Coinification of JDK7 Getting PostgreSQL HA to Work in vFabric Data Director November 9th, Oracle Solaris 11 Launch, New York City The [System] Developer's Edge: 322 page pdf Oracle Global IT Upgrades to Sun Storage Products UNIX - Dead or alive? LibreOffice Adopts ODF 1.2 as an OASIS Standard The Growth Prospects for Tape vs. HDD and NAND as a Storage Devices Blog RSS Feed