UPDATED 13:31 EDT / JANUARY 21 2015

Oracle Founder Larry Ellison NEWS

No, it’s not a typo: Oracle plugs a record 167 security holes

Oracle Founder Larry Ellison

Oracle rolled out a mammoth batch of patches on Tuesday in the first of four annual security fixes for its vast array of enterprise software products. What makes the otherwise routine update stand out is the sheer number of vulnerabilities addressed: a company-record 167.

One flaw that drew an outsized amount of attention is a misconfiguration affecting the enterprise technology stalwart’s popular E-Business Suite, which “gobsmacked” its discoverer, in his own words. David Litchfield, a U.K.-based expert on database security who is credited with uncovering hundreds of flaws, initially mistook the issue for a backdoor left behind by an hacker when he first spotted it while evaluating the defenses of a client.

Apparently, the default settings of the software gave users with the lowest level of authorization the ability to manipulate DUAL structure in the supporting Oracle database, a placeholder table that serves as a sort of built-in workaround for the limitations of SQL. It provides a straightforward way to execute commands that don’t require manipulating a specific piece of application data, such as determining the system date or checking account details.

But despite its innocuous applications, DUAL represents a massive target for hackers since it’s part of the data dictionary that keeps track of the information stored in relational tables. That means that a malicious party can take advantage of the vulnerability to execute a function against the table with full access privileges, laying the database bare for attack.

The most shocking part of the discovery is that such a conspicuous vulnerability passed Oracle’s quality assurance process, which Litchfield indicated should have been able to easily pick up on the issue as easily as he did and potential hackers might. While the misconfiguration still ranked fourth from last in Oracle’s rating of the severity of the exploits addressed in the update, it was notable for being so obvious.

The Oracle Sun Systems Products Suite shared the top spot with Java, which has a long history of vulnerabilities that has earned it a fair amount of criticism in the development community. The company assigned both flaws the highest possible rating on the CVSS v2 threat index, which means that they’re exploitable from outside the corporate network without the need for any kind of authentication.

U.S. Army Corps of Engineers photo

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU