This site uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Find out more.X

Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Share this article:

Patch Tuesday sees major slew of vulnerabilities to be fixed

Yahoo-culprit Java targeted as Oracle promises 147 security fixes
Yahoo-culprit Java targeted as Oracle promises 147 security fixes

Oracle is set to fix nearly 150 security flaws in its products during next week's ‘Patch Tuesday', including vulnerabilities in Java – the product at the heart of the recent Yahoo attack that may have seen millions of users plagued with malicious adverts.

On the same day, Microsoft will issue just four product patches that are rated ‘important' rather than ‘critical', affecting Microsoft Office, Windows and Dynamics.

The patches promised by Oracle comprise 147 new security vulnerability fixes across hundreds of its products including Oracle Database Server, Fusion middleware, Hyperion, the Oracle E-Business Suite, PeopleSoft and Oracle Siebel CRM.

Attention will focus on the 36 security fixes for Oracle Java SE. Oracle says of these: “Thirty four of these vulnerabilities may be remotely exploitable without authentication - ie, may be exploited over a network without the need for a username and password.”

In an emailed comment about the fixes, Qualys chief technology officer Wolfgang Kandek, said: “Java just suffered a widely published attack during the Yahoo ad-based attacks from December 30 2013 to January 3 2014, where the Magnitude exploit kit was used to deliver malware to users that were running an outdated version of Java.

“Oracle is coming out with Java v7u51, which is addressing a number of security flaws and further tightening its security parameters setup.”

Oracle itself advises that with this Critical Patch Update, “some of the vulnerabilities addressed affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible”.

Meanwhile, Kandek commented on the four expected Microsoft fixes: “We expect Bulletin number 2 to address the Zero-day vulnerability CVE-2013-5065 in Windows XP and 2003, which has seen limited attacks since the end of November of last year. These attacks have been coming in through PDF documents using an already fixed vulnerability of Adobe Reader and users of updated versions - ie post APSB13-15 from May of 2013 - should be immune to this attack vector.”

In the Java-based attack on Yahoo, revealed by Dutch security firm Fox-IT on 3 January, users visiting Yahoo.com - estimated to number in the millions - were served up with malicious adverts that directed them to scam websites. There they were exposed to the Magnitude malware which infects anyone who falls victim with a range of Trojans including Zeus, Andromeda and others.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more

More in News

Turn off WPS on routers for WiFi security

Turn off WPS on routers for WiFi security ...

A Swiss researcher is advocating turning off WPS to secure routers after finding a flaw that eliminates the randomness of codes generated by some routers when WPS is switched on...

Apple's iCloud hacked, nude celeb photos posted

Apple's iCloud hacked, nude celeb photos posted

Questions have been raised about the security of Apple's iCloud service, after a hacker posted nude pictures of celebrities to the 4Chan forum, claiming they were obtained after a hack ...