[BreachExchange] Massive Oracle Patch Reverses Company's Trend Toward Fewer Flaws

[Destry Winant]

https://www.darkreading.com/vulnerabilities---threats/vulnerability-management/massive-oracle-patch-reverses-companys-trend-toward-fewer-flaws/d/d-id/1336828

Following a year that saw the fewest number of vulnerabilities
reported since 2015, Oracle's latest quarterly patch fixes nearly 200
new vulnerabilities.

On Tuesday, six different software companies released fixes for their
applications, but perhaps the most worrisome was Oracle's release of a
massive critical patch update (CPU) that closes 334 different software
vulnerabilities, setting a record for the company's quarterly patches.

However, the count — provided by the US Department of Homeland
Security (DHS), which urged companies to patch quickly — refers to
every vulnerability fixed by the update. While there are 334 issues
fixed by Oracle's CPU, "only" 198 are new as of Jan. 14, says Brian
Martin, vice president of intelligence for vulnerability-information
firm Risk Based Security.

"The CPUs will contain a significant number of previously disclosed
vulnerabilities, often in third-party libraries," says Martin, adding
that "the sticker shock on the CPU warning is certainly there, but any
organization with decent vulnerability intel will have a head start as
far as knowing about some of the risk."

While 198 new vulnerabilities is not a record for Oracle, the massive
update does reverse a downward trend for the company. Oracle's
critical patch updates (CPUs) rolled up between 122 and 206
vulnerabilities over each of the past seven quarters, according to RBS
data. However, last year the company saw the fewest number of
vulnerabilities reported in the past four years, with 644
vulnerabilities — as represented by their Common Vulnerability
Enumeration (CVE) identifiers — published in the National
Vulnerability Database, compared to a peak of 893 vulnerabilities in
2017.

In fact, the numbers declined so much, hitting a quarterly low of 122
for the October 2018 CPU, that experts wondered whether Oracle had
managed to weed out the most easy-to-find issues, says RBS's Martin.
He sees the latest spike as bucking the trend, but could not say where
the trend is headed.

In the Jan. 14 advisory, Oracle warned its customers that some of the
patches fixed by its software updates were being used by attackers to
compromise systems. Rather than signal a new trend, exploitation of
some of the flaws in the massive update underscores a problem that
Oracle administrators routinely face.

"Oracle continues to periodically receive reports of attempts to
maliciously exploit vulnerabilities for which Oracle has already
released security patches," the company stated in its advisory. "In
some instances, it has been reported that attackers have been
successful because targeted customers had failed to apply available
Oracle patches. Oracle therefore strongly recommends that customers
remain on actively supported versions and apply Critical Patch Update
security patches without delay."

The patches should be applied quickly, which is typically an easy
decision for most companies, says Sebastian Bortnik, director of
research at enterprise-application security firm Onapsis.

"The patch process is not as simple as some other platforms, but once
you do it, you get all the patches at the same time," he says, "Of
course, you have to test the patches because most companies'
applications have a lot of custom code."

The most efficient way to deploy the CPU is to apply it to a
preproduction system and test it before pushing that system live,
Bortnik says. "While many customers will want to fully test the
patches, staging the patch to preproduction can work for some
customers," he says. "Thinking about the testing process for millions
of lines of custom code, this may be the best way to handle it."

The release came on a day when a number of major software firms —
Microsoft, Adobe, and SAP — also released their security updates. The
DHS's Cybersecurity and Infrastructure Security Agency (CISA) flagged
the release on Jan. 14, advising that a "remote attacker could exploit
some of these vulnerabilities to take control of an affected system"
and encouraging companies to "apply the necessary updates."

Both the growing number of applications that Oracle has under
development, as well as an increasing focus by security researchers on
such enterprise applications, will likely continue to result in more
vulnerability reports for the company to triage.

"With a growing software portfolio, that also means more pen testers
and employees with access to that software and the ability to test
could cause a shift in numbers, but we may also see some software drop
in vulnerability counts due to lack of interest or exhausting some of
the low-hanging vulnerabilities," RBS's Martin says.