This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Share this article:

Patch Tuesday sees major slew of vulnerabilities to be fixed

Yahoo-culprit Java targeted as Oracle promises 147 security fixes
Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Oracle is set to fix nearly 150 security flaws in its products during next week's ‘Patch Tuesday', including vulnerabilities in Java – the product at the heart of the recent Yahoo attack that may have seen millions of users plagued with malicious adverts.

On the same day, Microsoft will issue just four product patches that are rated ‘important' rather than ‘critical', affecting Microsoft Office, Windows and Dynamics.

The patches promised by Oracle comprise 147 new security vulnerability fixes across hundreds of its products including Oracle Database Server, Fusion middleware, Hyperion, the Oracle E-Business Suite, PeopleSoft and Oracle Siebel CRM.

Attention will focus on the 36 security fixes for Oracle Java SE. Oracle says of these: “Thirty four of these vulnerabilities may be remotely exploitable without authentication - ie, may be exploited over a network without the need for a username and password.”

In an emailed comment about the fixes, Qualys chief technology officer Wolfgang Kandek, said: “Java just suffered a widely published attack during the Yahoo ad-based attacks from December 30 2013 to January 3 2014, where the Magnitude exploit kit was used to deliver malware to users that were running an outdated version of Java.

“Oracle is coming out with Java v7u51, which is addressing a number of security flaws and further tightening its security parameters setup.”

Oracle itself advises that with this Critical Patch Update, “some of the vulnerabilities addressed affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible”.

Meanwhile, Kandek commented on the four expected Microsoft fixes: “We expect Bulletin number 2 to address the Zero-day vulnerability CVE-2013-5065 in Windows XP and 2003, which has seen limited attacks since the end of November of last year. These attacks have been coming in through PDF documents using an already fixed vulnerability of Adobe Reader and users of updated versions - ie post APSB13-15 from May of 2013 - should be immune to this attack vector.”

In the Java-based attack on Yahoo, revealed by Dutch security firm Fox-IT on 3 January, users visiting Yahoo.com - estimated to number in the millions - were served up with malicious adverts that directed them to scam websites. There they were exposed to the Magnitude malware which infects anyone who falls victim with a range of Trojans including Zeus, Andromeda and others.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

Google and Facebook offer free cyber-security tools

Google and Facebook offer free cyber-security tools

Google and Facebook have both launched free open-source cyber-security tools this week, designed to help security professionals spot malware and cyber-attacks.

Mixed results for key Government cyber-initiatives

Mixed results for key Government cyber-initiatives

The Government's Verify scheme to confirm IDs is behind scheuduled uptake, but its CISP threat intelligence sharing scheme is ahead of target.

Hundreds of companies face 2,000 cyber-attacks in EU exercise

Hundreds of companies face 2,000 cyber-attacks in EU ...

The European Network and Information Security Agency (ENISA) conducted a 24-hour cyber-exercise in which more than 200 organisations from 25 EU member states faced virtual cyber-attacks from white hat hackers ...