To print: Click here or Select File and then Print from your browser's menu

This story was printed from silicon.com, located at http://www.silicon.com/

Story URL: http://software.silicon.com/security/0,39024655,39156860,00.htm

Oracle issues product security fix
And says 'read all about it!'...

By Dawn Kawamoto

Published: Wednesday 01 March 2006

Oracle has issued an upgrade to its E-Business Suite 11i diagnostics module containing a number of security fixes, according to an alert from applications security firm Integrigy.

In releasing the upgrade, Oracle took an usual move by alerting its users about the security patches, according to Integrigy's advisory. Historically, the software maker has released product upgrades but not disclosed whether they included security fixes, Integrigy noted.

The Diagnostics Support Pack February 2006 with Oracle Diagnostics 2.3 RUP A aims to address security flaws in Oracle diagnostics web pages and Java classes, according to Integrigy. Oracle diagnostics, a troubleshooting module of Oracle E-Business Suite 11i, is designed to allow IT administrators to conduct tests when configuring and setting up applications.

According to the Integrigy report: "The significant [security] issue is [that] some diagnostics can be executed without any authentication, and it is possible to configure the diagnostics to be unrestricted."

The security patches are designed to limit access to the diagnostics tests.

Although the company releases quarterly security updates, "Oracle has not previously provided customers a notification that security fixes were included [in an upgrade]," Integrigy noted in its report. "We believe Oracle is encouraging customers to upgrade to the latest support diagnostics as a way to improve technical support and... accelerate the adoption of the diagnostics patch."

Oracle's next quarterly security update is scheduled for 18 April.

Oracle was not immediately available for comment.

Dawn Kawamoto writes for CNET News.com