Oracle rolled out a mammoth batch of patches on Tuesday in the first of four annual security fixes for its vast array of enterprise software products. What makes the otherwise routine update stand out is the sheer number of vulnerabilities addressed: a company-record 167.

One flaw that drew an outsized amount of attention is a misconfiguration affecting the enterprise technology stalwart’s popular E-Business Suite, which “gobsmacked” its discoverer, in his own words. David Litchfield, a U.K.-based expert on database security who is credited with uncovering hundreds of flaws, initially mistook the issue for a backdoor left behind by an hacker when he first spotted it while evaluating the defenses of a client.

Apparently, the default settings of the software gave users with the lowest level of authorization the ability to manipulate DUAL structure in the supporting Oracle database, a placeholder table that serves as a sort of built-in workaround for the limitations of SQL. It provides a straightforward way to execute commands that don’t require manipulating a specific piece of application data, such as determining the system date or checking account details.

But despite its innocuous applications, DUAL represents a massive target for hackers since it’s part of the data dictionary that keeps track of the information stored in relational tables. That means that a malicious party can take advantage of the vulnerability to execute a function against the table with full access privileges, laying the database bare for attack.

The most shocking part of the discovery is that such a conspicuous vulnerability passed Oracle’s quality assurance process, which Litchfield indicated should have been able to easily pick up on the issue as easily as he did and potential hackers might. While the misconfiguration still ranked fourth from last in Oracle’s rating of the severity of the exploits addressed in the update, it was notable for being so obvious.

The Oracle Sun Systems Products Suite shared the top spot with Java, which has a long history of vulnerabilities that has earned it a fair amount of criticism in the development community. The company assigned both flaws the highest possible rating on the CVSS v2 threat index, which means that they’re exploitable from outside the corporate network without the need for any kind of authentication.

U.S. Army Corps of Engineers photo