This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Share this article:

Patch Tuesday sees major slew of vulnerabilities to be fixed

Yahoo-culprit Java targeted as Oracle promises 147 security fixes
Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Oracle is set to fix nearly 150 security flaws in its products during next week's ‘Patch Tuesday', including vulnerabilities in Java – the product at the heart of the recent Yahoo attack that may have seen millions of users plagued with malicious adverts.

On the same day, Microsoft will issue just four product patches that are rated ‘important' rather than ‘critical', affecting Microsoft Office, Windows and Dynamics.

The patches promised by Oracle comprise 147 new security vulnerability fixes across hundreds of its products including Oracle Database Server, Fusion middleware, Hyperion, the Oracle E-Business Suite, PeopleSoft and Oracle Siebel CRM.

Attention will focus on the 36 security fixes for Oracle Java SE. Oracle says of these: “Thirty four of these vulnerabilities may be remotely exploitable without authentication - ie, may be exploited over a network without the need for a username and password.”

In an emailed comment about the fixes, Qualys chief technology officer Wolfgang Kandek, said: “Java just suffered a widely published attack during the Yahoo ad-based attacks from December 30 2013 to January 3 2014, where the Magnitude exploit kit was used to deliver malware to users that were running an outdated version of Java.

“Oracle is coming out with Java v7u51, which is addressing a number of security flaws and further tightening its security parameters setup.”

Oracle itself advises that with this Critical Patch Update, “some of the vulnerabilities addressed affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible”.

Meanwhile, Kandek commented on the four expected Microsoft fixes: “We expect Bulletin number 2 to address the Zero-day vulnerability CVE-2013-5065 in Windows XP and 2003, which has seen limited attacks since the end of November of last year. These attacks have been coming in through PDF documents using an already fixed vulnerability of Adobe Reader and users of updated versions - ie post APSB13-15 from May of 2013 - should be immune to this attack vector.”

In the Java-based attack on Yahoo, revealed by Dutch security firm Fox-IT on 3 January, users visiting Yahoo.com - estimated to number in the millions - were served up with malicious adverts that directed them to scam websites. There they were exposed to the Magnitude malware which infects anyone who falls victim with a range of Trojans including Zeus, Andromeda and others.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

Shellshock: Millions of servers under attack

Shellshock: Millions of servers under attack

In the wake of Shellshock, end-users and security managers race to patch web servers and desktops, but may be forgetting vulnerable embedded devices.

Londoners agree to give child away in return for free WiFi

Londoners agree to give child away in return ...

Hundreds trapped and exposed by fake 'poisoned' WiFi hotspot.

Cybercrime-as-a-service the new criminal business model

Cybercrime-as-a-service the new criminal business model

A new report from Europol's European Cybercrime Centre (EC3) reveals that cybercrime is being increasingly commercialised, and by criminals who use legitimate services to hide their activities.