TeamShatter has reported six severe vulnerabilities resident within Oracle Corporation's (NasdaqGS: ORCL) Oracle Enterprise Manager DB Grid Control management facility.
Quite negative news indeed, for the all-encompassing server, daemon, code and database control product, not to mention the huge numbers of deployed bits in both the public and private sectors. Recent Java exploits, piggybacked on these Oracle Enterprise Manager vulns, puts the database leviathan into a tenuous posture of insecure cruft deployment.
Whilst all of the enumerated vulns have been officially patched by the company, a vast ocean of deployments are not being updated, generally due to recalcitrant DBAs and their System Administrator colleagues (thereby displaying misguided rationale, as generally, they're fearful of patchsets targeting Oracle products, due to the severe impact of the crufty bits applied to extant Oracle instances, and the subsequent possibility of significant downtime). - mxh
ℇ ℈ ℊ ℋ ℌ ℑ