Yo, sysadmins! Thought Patch Tuesday was big? Oracle says 'hold my Java' with huge 334 security flaw fix bundle

House of Larry delivers massive update for 93 products

Oracle has released a sweeping set of security patches across the breadth of its software line.

The January update, delivered one day after Microsoft, Intel, Adobe, and others dropped their scheduled monthly patches, addresses a total of 334 security vulnerabilities across 93 different products from the enterprise giant.

As you may imagine, most IT admins will only need to test and apply a handful of the updates for their specific platforms.

For Oracle's flagship Database Server, the update includes an even dozen patches. Three of those are remotely exploitable without authorization, including one flaw in Apache Tomcat (CVE-2019-10072), one in Big Red's database gateway (CVE-2020-2512), and one for the Core RDBMS product (CVE-2020-2510). The highest CVSS rating was afforded to CVE-2020-2511, a locally-exploitable flaw in Core RDBMS, which scored at 7.7.

Some of the highest severity flaws were found in Oracle's communications apps, where 23 of the 25 CVE-listed bugs were said to be remotely exploitable without the need for any authentication. Six of those were given CVSS scores of 9 or higher.

Fusion Middleware was host to 38 CVE-listed bugs, 30 remotely exploitable and three (CVE-2020-2555, CVE-2020-2551, CVE-2020-2546) that were assigned CVSS scores of 9.8 out of 10. In other words - patch them now.

Solaris was the recipient of 10 patches this time around, though only two of those were found to be remotely exploitable. The Sun ZFS Storage Appliance Kit was host to a particularly nasty RCE flaw, CVE-2019-9636.

Also of note was CVE-2020-2696, an elevation of privilege flaw in the Solaris 10 Common Desktop Environment, which was discovered by Marco Ivaldi, principal security adviser at Italian infosec shop Mediaservice.net. In a detailed dissection of the bug, Ivaldi describes the flaw as a "cute straight-out-of-the-manual memory corruption" issue, and suggested a number of similar bugs are likely to exist.

"During my audit, many other potentially exploitable bugs have surfaced in dtsession and in the Common Desktop Environment in general," said Ivaldi. "Therefore, regardless of patches released by vendors, you should really consider removing the setuid bit from all CDE binaries."

Now that details on the vulnerabilities are out, admins are encouraged to test and apply all of the Oracle patches as soon as possible. ®