Here is a brief analysis of thefor the upcoming April 2008 Oracle Critical Patch Update (CPU) -
- Overall, 41 security vulnerabilities are fixed in this CPU, which is an average number well within the range of previous CPUs (Jan-08=26, Oct-07=51, Jul-07=45, Apr-07=36, Jan-07=51, Oct-06=101, Jul-06=62, Apr-06=34, Jan-06=80).
- This is the first CPU that includes fixes for Siebel.
- The product and vulnerability mix appears to be similar to previous CPUs. All CPU supported Oracle Database, Oracle Application Server, Oracle Collaboration Suite, and Oracle E-Business Suite versions are included. The list of supported versions is getting very short and should be carefully reviewed to determine if version upgrades are required prior to applying the CPU security patches -
- Database = 220.127.116.11, 10.1.0.5, 10.2.0.3, and 18.104.22.168 for major platforms
- Application Server = 22.214.171.124, 10.1.2, and 10.1.3
- E-Business Suite = 11.5.9, 11.5.10.x, and 12.0.x
- The major CPU version support changes for April 2008 are -
- Database version 10.2.0.2 is only supported for Solaris x86 and VMS
- Oracle E-Business Suite 11i will require ATG RUP5 or RUP6
- Oracle instituted a new policy with the July 2007 CPU in that platforms with few downloads of CPU patches will not have patches proactively created -- the CPU patches will only be available upon request. According to the January 2008 CPU note (Metalink Note ID 466757.1), patches for database version 10.1.0.5 on several platforms will be available only upon request for the April 2008 CPU. For the Oracle Application Server, many platforms have "On Request" patches across all versions, especially 126.96.36.199. The database note for the January 2008 CPU will have a section titled "Planned Patches for Next CPU Release" that should be carefully reviewed to determine if your platform/version will be an "On Request" patch in the next release.
- There are 17 database vulnerabilities and two are remotely exploitable without authentication. Since APEX, Net Services, Authentication, and UltraSearch are included as affected components, it will be very interesting to see where the remotely exploitable vulnerabilities lie.
- At least one of the database security vulnerabilities has a 2.0 metric of 6.6, which for database vulnerabilities should be considered high risk. This typically means anyone with a valid database session is able to compromise the entire database, but is unable to achieve root operating system access.
- According to the January 2008 CPU notes, there is very limited platform support for 10.2.0.2. Only the following platforms are supported for 10.2.0.2 by the April 2008 CPU: Solaris X86 and VMS.
Oracle Application Server
- There are 3 new Oracle Applications vulnerabilities, all of which are remotely exploitable without authentication. Two impact the Oracle Application server components Oracle Dynamic Monitoring Service and Oracle Portal. The third vulnerability is in Oracle Jinitiator, which is a client installed product.
Oracle E-Business Suite 11i and R12
- 7 of the 11 vulnerabilities in the Oracle E-Business Suite are remotely exploitable without authentication. Most of the vulnerabilities are in core components like OA Framework and AOL, so all implementations should consider most of these patches as important.
- As with all previous CPUs, this quarter's security patches should be deemed critical and you should adhere to the established procedures and timing used for previous CPUs.
Note: The pre-release announcement is removed when the CPU is released.