Oracle patches 11i security flaws

Oracle has issued an upgrade to its E-Business Suite 11i diagnostics module containing a number of the security fixes, according to applications security firm Integrigy.

In releasing the upgrade, Oracle made an usual move by alerting its users about the security patches, according to Integrigy's advisory. Historically, the software maker has released product upgrades but not disclosed whether they included security fixes, Integrigy noted.

The "Diagnostics Support Pack February 2006 with Oracle Diagnostics 2.3 RUP A" aims to address security flaws in Oracle diagnostics Web pages and Java classes, according to Integrigy. Oracle diagnostics, a troubleshooting module of Oracle E-Business Suite 11i, is designed to allow IT administrators to conduct tests when configuring and setting up applications.

"The significant (security) issue is (that) some diagnostics can be executed without any authentication, and it is possible to configure the diagnostics to be unrestricted," according to the Integrigy report.

The security patches are designed to limit access to the diagnostics tests.

Although the company releases quarterly security updates, "Oracle has not previously provided customers a notification that security fixes were included (in an upgrade)," Integrigy noted in its report. "We believe Oracle is encouraging customers to upgrade to the latest support diagnostics as a way to improve technical support and...accelerate the adoption of the diagnostics patch."

Oracle's next quarterly security update is scheduled for April 18.

Oracle was not immediately available for comment.

[jmhmaine]

Where's my Million Dollars?

Where's our Million Dollars? Wasn't Oracle going pay a million dollars if someone found security flaws? Listening to Larry Ellison I thought Oracle didn't have security issues...I guess his staff is picking up the broken pieces of his glass house...