This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Share this article:

Patch Tuesday sees major slew of vulnerabilities to be fixed

Yahoo-culprit Java targeted as Oracle promises 147 security fixes
Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Oracle is set to fix nearly 150 security flaws in its products during next week's ‘Patch Tuesday', including vulnerabilities in Java – the product at the heart of the recent Yahoo attack that may have seen millions of users plagued with malicious adverts.

On the same day, Microsoft will issue just four product patches that are rated ‘important' rather than ‘critical', affecting Microsoft Office, Windows and Dynamics.

The patches promised by Oracle comprise 147 new security vulnerability fixes across hundreds of its products including Oracle Database Server, Fusion middleware, Hyperion, the Oracle E-Business Suite, PeopleSoft and Oracle Siebel CRM.

Attention will focus on the 36 security fixes for Oracle Java SE. Oracle says of these: “Thirty four of these vulnerabilities may be remotely exploitable without authentication - ie, may be exploited over a network without the need for a username and password.”

In an emailed comment about the fixes, Qualys chief technology officer Wolfgang Kandek, said: “Java just suffered a widely published attack during the Yahoo ad-based attacks from December 30 2013 to January 3 2014, where the Magnitude exploit kit was used to deliver malware to users that were running an outdated version of Java.

“Oracle is coming out with Java v7u51, which is addressing a number of security flaws and further tightening its security parameters setup.”

Oracle itself advises that with this Critical Patch Update, “some of the vulnerabilities addressed affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible”.

Meanwhile, Kandek commented on the four expected Microsoft fixes: “We expect Bulletin number 2 to address the Zero-day vulnerability CVE-2013-5065 in Windows XP and 2003, which has seen limited attacks since the end of November of last year. These attacks have been coming in through PDF documents using an already fixed vulnerability of Adobe Reader and users of updated versions - ie post APSB13-15 from May of 2013 - should be immune to this attack vector.”

In the Java-based attack on Yahoo, revealed by Dutch security firm Fox-IT on 3 January, users visiting - estimated to number in the millions - were served up with malicious adverts that directed them to scam websites. There they were exposed to the Magnitude malware which infects anyone who falls victim with a range of Trojans including Zeus, Andromeda and others.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud

Exclusive video webcast & Q&A sponsored by Vormetric

As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.

View the webcast here to find out more

More in News

Queen's website hosts controversial tracking technique

Queen's website hosts controversial tracking technique

Advertising tracking called 'canvas fingerprinting' is used on many websites and identifies unique individuals and their browsing habits and works surreptitiously.

Could MH17 sanctions push Russia to cyber warfare?

Could MH17 sanctions push Russia to cyber warfare?

A leading cyber security academic has warned the US and European governments that tougher sanctions on Russia relating to the MH17 airplane crash could result in the start of cyber ...

Snowden, Ellsberg ask hackers to help obscure whistleblower activity

Snowden, Ellsberg ask hackers to help obscure whistleblower ...

Crowds of people came out to see Daniel Ellsberg chat with Edward Snowden at HOPE X conference.