Oracle fixes Struts and Shadow Brokers exploits in huge patch release
20 April 2017 | 0
Oracle has released a record 299 security fixes for vulnerabilities in its products, including patches for a widely-exploited vulnerability in the Apache Struts framework and a Solaris exploit supposedly used by the US National Security Agency.
The Struts vulnerability allows for remote code execution on Java web servers and was patched on 6 March. Attackers have quickly adopted it and have used it in widespread attacks since then.
Oracle uses Apache Struts 2 in several of its products, which is why Tuesday’s critical patch update (CPU) fixed 25 instances of the vulnerability in Oracle Communications, Retail and Financial Services applications, as well as in the MySQL Enterprise Monitor, Oracle WebCenter Sites, Oracle WebLogic Server and the Siebel E-Billing app.
The company also fixed the vulnerability behind the EXTREMEPARR exploit for Solaris 10 that was leaked recently by a group called Shadow Brokers as part of a larger data dump of alleged NSA cyber tools. Another Solaris exploit that was part of the same arsenal and was dubbed EBBISLAND has been patched since 2012 in Solaris 10 Update 11, Oracle said.
Oracle’s quarterly patch bundle contains fixes for 40 vulnerabilities that are rated as critical, 25 of which have the highest severity score of 10 in the Common Vulnerability Scoring System (CVSS). Overall, 162 out of the 299 patched vulnerabilities are remotely exploitable.
Oracle’s applications for specific industry sectors — financial services, retail, communications, utilities, hospitality, health sciences and insurance — account for almost 40 percent of all security fixes this quarter, according to an analysis by security vendor ERPScan.
Oracle business-critical applications like Oracle PeopleSoft, E-Business Suite, JD Edwards, Siebel CRM and the Primavera Products Suite received 83 security fixes.
“Nowadays, hackers set their eyes on enterprises more than on individuals, as they understood that this option is more profitable,” said Alexander Polyakov, CTO at ERPScan. “Taking into account that Oracle’s products are installed in the largest enterprises, these applications can be the ultimate target.”
IDG News Service