Oracle is set to fix nearly 150 security flaws in its products during next week's ‘Patch Tuesday', including vulnerabilities in Java – the product at the heart of the recent Yahoo attack that may have seen millions of users plagued with malicious adverts.
On the same day, Microsoft will issue just four product patches that are rated ‘important' rather than ‘critical', affecting Microsoft Office, Windows and Dynamics.
The patches promised by Oracle comprise 147 new security vulnerability fixes across hundreds of its products including Oracle Database Server, Fusion middleware, Hyperion, the Oracle E-Business Suite, PeopleSoft and Oracle Siebel CRM.
Attention will focus on the 36 security fixes for Oracle Java SE. Oracle says of these: “Thirty four of these vulnerabilities may be remotely exploitable without authentication - ie, may be exploited over a network without the need for a username and password.”
In an emailed comment about the fixes, Qualys chief technology officer Wolfgang Kandek, said: “Java just suffered a widely published attack during the Yahoo ad-based attacks from December 30 2013 to January 3 2014, where the Magnitude exploit kit was used to deliver malware to users that were running an outdated version of Java.
“Oracle is coming out with Java v7u51, which is addressing a number of security flaws and further tightening its security parameters setup.”
Oracle itself advises that with this Critical Patch Update, “some of the vulnerabilities addressed affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible”.
Meanwhile, Kandek commented on the four expected Microsoft fixes: “We expect Bulletin number 2 to address the Zero-day vulnerability CVE-2013-5065 in Windows XP and 2003, which has seen limited attacks since the end of November of last year. These attacks have been coming in through PDF documents using an already fixed vulnerability of Adobe Reader and users of updated versions - ie post APSB13-15 from May of 2013 - should be immune to this attack vector.”
In the Java-based attack on Yahoo, revealed by Dutch security firm Fox-IT on 3 January, users visiting Yahoo.com - estimated to number in the millions - were served up with malicious adverts that directed them to scam websites. There they were exposed to the Magnitude malware which infects anyone who falls victim with a range of Trojans including Zeus, Andromeda and others.