Home Programs Emergency management Response CCIRC Analytical releases2 AV06-045: Oracle Critical Patch Update -- October 2006

Oracle Critical Patch Update -- October 2006

Number: AV06-045
Date: 18 October 2006

Purpose

The purpose of this advisory is to bring attention to the quarterly Oracle Critical Patch Update, for October 2006.  A Critical Patch Update is a collection of patches for multiple security vulnerabilities. It also includes non-security fixes that are required (because of interdependencies) by those security patches. This Critical Patch Update contains 101 new security fixes across all products.

Assessment

This Oracle critical patch update addresses vulnerabilities in the following products:

Category I

- Premier Support or Extended Support, under the Oracle Lifetime Support policy; or Error Correction Support (ECS) or Extended Maintenance Support (EMS), under the previous support policy:

• Oracle Database 10g Release 2, versions 10.2.0.1, 10.2.0.2
• Oracle Database 10g Release 1, versions 10.1.0.4, 10.1.0.5
• Oracle9i Database Release 2, versions 9.2.0.6, 9.2.0.7
• Oracle8i Database Release 3, version 8.1.7.4
• Oracle Application Express (formerly called HTML DB), versions 1.5 - 2.0
• Oracle Application Server 10g Release 3, version 10.1.3.0.0
• Oracle Application Server 10g Release 2, versions 10.1.2.0.0 - 10.1.2.0.2, 10.1.2.1.0
• Oracle Application Server 10g Release 1 (9.0.4), versions 9.0.4.2, 9.0.4.3
• Oracle Collaboration Suite 10g Release 1, version 10.1.2.0
• Oracle9i Collaboration Suite Release 2, version 9.0.4.2
• Oracle E-Business Suite Release 11i, versions 11.5.7 - 11.5.10 CU2
• Oracle E-Business Suite Release 11.0
• Oracle Pharmaceutical Applications versions 4.5.0 - 4.5.1
• Oracle PeopleSoft Enterprise PeopleTools versions 8.22, 8.46, 8.47, 8.4
• Oracle PeopleSoft Enterprise Portal Solutions, Enterprise Portal, versions 8.8, 8.9
• JD Edwards EnterpriseOne Tools versions 8.95, 8.96
• JD Edwards OneWorld Tools SP23

Category II

- Products and components that are bundled with the products listed in Category I:

• Oracle Developer Suite, versions 6i, 9.0.4.1, 9.0.4.2, 9.0.4.3, 10.1.2.0.2, 10.1.2.2

Category III

- Products that are de-supported as a standalone installation but are supported when installed with the products listed in Category I:

• Oracle9i Database Release 1, version 9.0.1.4
• Oracle9i Database Release 1, versions 9.0.1.5, 9.0.1.5 FIPS
• Oracle9i Application Server Release 2, versions 9.0.2.3, 9.0.3.1
• Oracle9i Application Server Release 1, version 1.0.2.2

Category IV

- Products that are supported only on selected platforms:

• Oracle Database 10g Release 1, version 10.1.0.3
• Oracle9i Database Release 2, version 9.2.0.5
• Oracle Application Server 10g Release 1 (9.0.4), version 9.0.4.1

Suggested action

PSEPC recommends that administrators test and apply the patches provided in the Oracle Critical Patch Update - October 2006 at the earliest opportunity.  For more information, please refer to:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2006.html?_template=/ocom/technology/content/print

Note to readers

Canadian Cyber Incident Response Centre (CCIRC) collects information related to cyber threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at 613-991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail.

Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at 613-993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at 613-993-9620.

For urgent matters or to report any incidents, please contact the Government Operations Centre at:

Phone: 613-991-7000
Fax: 613-996-0995
Secure Fax: 613-991-7094
Email: goc-cog@psepc-sppcc.gc.ca

For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@psepc-sppcc.gc.ca