Oracle releases security fixes for supported on-premises (non-cloud) products as part its regular Critical Patch Updates (CPUs) cycle. The current release schedule for CPUs is on the third Tuesday of January, April, July, and October each year. Additional security fixes are occasionally released outside of the normal cycle, but these are known as “out-of-band” security alerts and bulletins.

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply all applicable security patches found within the Critical Patch Updates as soon as possible.

In this blog post, we will be summarising key details for the security patches contained within the latest product updates. The raw list can be viewed in full directly here: https://www.oracle.com/security-alerts/cpuoct2024.html. You can also access a list of historical CPUs here: https://www.oracle.com/security-alerts/.

Commentary

A slightly smaller set of vulnerabilities to patch this quarter compared to Oracle’s last CPU advisory – but certain products have been hit especially hard. Oracle Communications (and Cloud Native Core in particular) was affected by vulnerabilities accounting for over 100 new security patches of the 334 released for Oracle products. 81 of these were remotely exploitable without authentication, and with the most serious having a maximum CVSS score of 9.8 out of 10. Many of the vulnerabilities in this quarter’s updates also lay in underlying third-party libraries from open-source projects, which Oracle products incorporate for delivering specific functionality. These included flaws in OpenSSL, Log4J, libexpat and Apache CXF.

The Oracle Critical Patch Updates for 17th July through 15th October 2024 also includes important updates for vulnerabilities in other products including: Analytics, Application Express, Commerce, Database Server, E-Business Suite, Essbase, Financial Services, Fusion, Hyperion, Java SE, MySQL, NoSQL, PeopleSoft, Retail Applications, Secure Backup, SQL Developer, and Siebel CRM.

34 ‘Highly Exploitable’ Critical Vulnerabilities

The list of “Highly Exploitable” critical vulnerabilities below are those which have a ‘critical’ impact – rated as 9.0 or more out of 10 under the “CVSS” (Common Vulnerability) scoring system – but are also considered to be relatively trivial to exploit. They have (a) a network attack vector, (b) a low attack complexity, and (c) are remotely exploitable without authentication. This reflects those vulnerabilities that are believed to present the most critical risk to organisations, since they are both trivial to target, as well as having the potential to have significant impact (harm) if successfully exploited. “Highly exploitable” critical vulnerabilities are crucial to patch, and remediation is time sensitive – these type of vulnerabilities often feature in our “Known Exploited Vulnerabilities” (KEV) roundups as undergoing active exploitation if a threat group develops working exploit code and begins to actively target organisations. The vulnerabilities regarded as ‘highly exploitable’ criticals in Oracle products this month includes:

2 Other Critical (CVSS 9+) Patches to Prioritise

Although Oracle considers all 334 vulnerabilities in their update to be critical, the list of “Critical” vulnerabilities below are those that Oracle have assigned a CVSS score of 9.0 or more, the threshold for ‘critical’ risk under the CVSS scoring system. Unlike the ‘highly exploitable’ vulnerabilities listed above, these vulnerabilities may be slightly more difficult for attackers to leverage. They may, for instance, not be remotely exploitable, or may require authentication in order to access. Potential exploit is still possible, especially as part of an exploit chain of multiple vulnerabilities. However, although the risk remains extremely high, it is slightly lower than that of the “highly exploitable” vulnerabilities listed above. Additional critical vulnerabilities highlighted by Oracle this month include:

Statistics

Total Oracle CVEs: 329
Highly Exploitable Critical Vulnerabilities: 34
Total Critical Vulnerabilities: 36

How to Protect Your Organisation with AppCheck

We recommend scanning your entire estate using the AppCheck vulnerability scanner regularly – both server systems and networking infrastructure, as well as end-user machines running desktop operating systems. Contact your account manager now if you are not already licensed for ‘internal scan hubs’ to cover scanning of your entire technical estate.

Next Patch Tuesday

The next four dates for Critical Patch Updates will be on:

* 21 January 2025
* 15 April 2025
* 15 July 2025
* 21 October 2025

Add them to your calendar now!

Also keep an eye on our blog for coverage of other critical vulnerability updates including:

* Our weekly roundup of ‘Known exploited vulnerabilities’ from across all vendors, published weekly each Friday.
* Our monthly coverage of the ‘Patch Tuesday’ updates from Microsoft and several other major vendors – next due on 12th November 2024

About AppCheck

AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure. AppCheck are authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA).