Some Oracle customers using the Windows operating system will have to wait another two weeks to receive a critical software update to their database software, after a glitch emerged in testing.
Oracle unveiled its quarterly release of software patches on 17 April, fixing not only database flaws, but also bugs in a host of other applications. In total, the patches fix 36 vulnerabilities, 13 of which relate directly to the database.
However, the most serious database flaw discussed in April's Critical Patch Update will not actually become available for users of the 126.96.36.199 version of Oracle's database until 30 April. This is because of issues that arose in testing, said Darius Wiles, a manager with Oracle Security Alerts. The bug affects only the Windows platform and is patched on all other supported versions of the database, he said.
That flaw, known as DB01, is in the Core RDBMS (relational database management system) used by Oracle's database. It can be remotely exploited over the network and unlike most of the database flaws, an attacker does not need to have authentication rights to the database to exploit the problem.
Wiles said it was the most critical flaw patched by Oracle this month. It is the only database flaw patched this quarter to be given the relatively severe 7.0 rating on the Common Vulnerability Scoring System. All other database patches scored a 3.4 or less.
One security expert says that it looks like this flaw could be used to shut down or gain access to a database. In theory, it could even be exploited to run unauthorised software on the database server, said Alexander Kornbrust, a business director at Red-Database-Security. "I think people will now concentrate on this vulnerability," he said.
Also patched in this quarterly release are Oracle's Application Server, Collaboration Suite, E-Business Suite, and Enterprise Manager, as well as the company's PeopleSoft and JD Edwards applications.
Oracle said that its next update, due on 17 July, it will see a reduced number of patches released for its server and middleware products, with the company no longer automatically producing patches for some versions of its products on platforms that are rarely used.
"Instead of systematically creating a Critical Patch Updates for those inactive combinations, we will only produce those patches if clients specifically request them," wrote Eric Maurice, a manager in Oracle's Global Technology Business Unit, in a blog posting.
Though these patches will not be shipped as part of the quarterly security updates, they will eventually make their way into Oracle's products through Oracle's other software update mechanisms, which update code less frequently than the Critical Patch process, a company spokeswoman said.