甲骨文发布2012 1月数据库安全补丁Critical Patch Update January 2012

甲骨文公司(Oracle Corp)会在今天的(2012-01-17 Tuesday)的晚些时候发布最新的数据库安全补丁Critical Patch Update January 2012;

在OTN的CPU security专题页面上已经生成了《Oracle Critical Patch Update Pre-Release Announcement – January 2012》的页面;将要发布的安全补丁涵盖多个版本的Oracle数据库:

 

Affected Products and Components

Security vulnerabilities addressed by this Critical Patch Update affect the following products:

  • Oracle Database 11g Release 2, versions 11.2.0.2, 11.2.0.3
  • Oracle Database 11g Release 1, version 11.1.0.7
  • Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5
  • Oracle Database 10g Release 1, version 10.1.0.5

 

实际因为版本10gR2已经正式进入Extended Support扩展支持阶段,所以下载10.2.0.4、10.2.0.5今后的CPU、PSU将(10.2.0.4.10、10.2.0.5.5 以后)需要用户已购买甲骨文公司的扩展支持服务包。

 

“甲骨文称,有27个补丁是修复MySQL数据库中的安全漏洞。其中一个安全漏洞不需要登录证书就可以在网络上利用。按照通用安全漏洞评分系统(CVSS)数据库的平分,MySQL数据库安全漏洞的最高等级是5.5,属于中等风险等级。

另外两个补丁修复甲骨文数据中的安全漏洞。甲骨文还计划为Fusion中间件软件发布11个补丁。其中修复的5个安全漏洞能够远程利用,不需要用户身份识别。

在应用程序方面,甲骨文电子商务套装软件将得到3个安全补丁。供应链应用套装软件将得到1个安全补丁。仁科软件得到6个补丁。JD Edwards软件得到8个补丁。

大约17个安全补丁与Sun的产品有关,其中包括6个不需要证书就可以远程利用的安全漏洞。受影响的产品包括GlassFish企业服务器和和Solaris OS。

另外3个补丁用于甲骨文包括VirtualBox在内的虚拟化技术。”

 

在My Oracle Support (MOS)服务站点上已经生成了<Oracle Critical Patch Update January 2012 Documentation Map [ID 1368685.1]>这个补丁文档patch note:

 

“Oracle provides Critical Patch Updates to its customers to fix security vulnerabilities. This document defines the Documentation Map to documents identifying patches and minimum releases that are required for the Oracle products to address the security vulnerabilities that are announced in the Advisory for January 2012 (the updates will be entered here when CPU is released). ”

 

补丁列表已发布:

 

Patch Availability for Oracle Database 11.2.0.3

 

Oracle Database 11.2.0.3 UNIX Microsoft Windows (32-Bit) Microsoft Windows x64 (64-bit) Advisory Number Comments
Oracle Database home CPU Patch 13466801, or DB PSU Patch 13343438, or GI PSU Patch 13348650, or Database patch for Exadata Patch 13513783, or Quarterly Full Stack download for Exadata Patch 13551280 Bundle Patch 13413167 Bundle Patch 13413168

 

Patch Availability for Oracle Database 11.2.0.2

 

Oracle Database 11.2.0.2 UNIX Microsoft Windows (32-Bit) Microsoft Windows x64 (64-bit) Advisory Number Comments
Oracle Database home CPU Patch 13343244, or DB PSU Patch 13343424, or GI PSU Patch 13343447, or Exadata Database Recommended Patch 14 Patch 13556724 Bundle Patch 13413154 Bundle Patch 13413155 CVE-2012-0072, CVE-2012-0082

 

Patch Availability for Oracle Database 11.1.0.7

 

Oracle Database 11.1.0.7 UNIX Microsoft Windows (32-Bit) Microsoft Windows x64 (64-Bit) Advisory Number Comments
Oracle Database home CPU Patch 13343453, or PSU Patch 13343461 Bundle Patch 13460955 Bundle Patch 13460956 CVE-2012-0072, CVE-2012-0082
Oracle Database home Patch 9288120 Patch 9288120 Patch 9288120 Released April 2011 Database UIX

For Oracle Secure Enterprise Search 11.1.2.x installations, follow the instructions given in MOS note Note 1359600.1.

Oracle Database home Patch 10073948 Patch 10073948 Patch 10073948 Released April 2011 Enterprise Manager Database Control UIX

Not applicable to Oracle Secure Enterprise Search 11.1.2.x

Oracle Database home Patch 11738232 Patch 11738232 Patch 11738232 Released April 2011 Warehouse Builder

Not applicable to Oracle Secure Enterprise Search 11.1.2.x

 

Patch Availability for Oracle Database 10.2.0.5

 

Oracle Database 10.2.0.5 UNIX Microsoft Windows (32-Bit) Microsoft Windows Itanium (64-Bit) Microsoft Windows x64 (64-Bit) Advisory Number Comments
Oracle Database home CPU Patch 13343467, or PSU Patch 13343471 Bundle Patch 13460967 NA Bundle Patch 13460968 CVE-2012-0072, CVE-2012-0082
Oracle Database home Patch 12536181 NA NA NA Released July 2011 Enterprise Manager Database Control

For HP-UX PA-RISC and HP-UX Itanium platforms only

Oracle Database home Patch 11738172 Patch 11738172 Patch 11738172 Patch 11738172 Released April 2011 Warehouse Builder

 

 

Patch Availability for Oracle Database 10.2.0.4

 

Oracle Database 10.2.0.4 UNIX Advisory Number Comments
Oracle Database home CPU Patch 12879912, or PSU Patch 12879929 CVE-2012-0072, CVE-2012-0082
Oracle Database home Patch 12536167 Released July 2011 Enterprise Manager Database Control

For HP-UX PA-RISC and HP-UX Itanium platforms only

Oracle Database home Patch 9249369 Released April 2011 Database UIX
Oracle Database home Patch 12758181 Released July 2011 Enterprise Manager Database Control UIX
Oracle Database home Patch 9273865 Released April 2011 iSqlPlus UIX

 

Component IBM zSeries (z/OS) Advisory Number Comments
Oracle Database home CPU Patch 13343479 CVE-2012-0072, CVE-2012-0082

 

Patch Availability for Oracle Database 10.1.0.5

 

Oracle Database 10.1.0.5 UNIX Microsoft Windows (32-Bit) Microsoft Windows Itanium (64-Bit) Advisory Number Comments
Oracle Database home Patch 6640838 Patch 6640838 Patch 6640838 Released October 2010 Oracle Universal Installer
Oracle Database home Patch 11842285 NA NA Released July 2011 Oracle Universal Installer
Oracle Database home CPU Patch 13343482 Bundle Patch 13413002 Bundle Patch 13413003 CVE-2012-0072, CVE-2012-0082
Oracle Database home Patch 12535977 NA NA Released July 2011 Enterprise Manager Database Control

For HP-UX PA-RISC and HP-UX Itanium platforms only

Oracle Workspace Manager home Patch 7341989 Patch 7341989 Patch 7341989 Released April 2009
Oracle Database home Patch 9249369 Patch 9249369 Patch 9249369 Released April 2011 Database UIX
Oracle Database home Patch 10036362 Patch 10036362 Patch 10036362 Released April 2011 Enterprise Manager Database Control UIX
Oracle Database home Patch 9273888 Patch 9273888 Patch 9273888 Released April 2011 iSqlPlus UIX

 

Patch Set Update Availability for Oracle Database

 

Oracle Database UNIX Advisory Number Comments
11.2.0.2.4 Database PSU Patch 13343424 See Section 3.1.3.3, “Oracle Database 11.2.0.2”
11.2.0.2.4 Grid Infrastructure PSU Patch 13343447 See Section 3.1.3.3, “Oracle Database 11.2.0.2” Includes CPUJan2012 and 11.2.0.2.4 Database PSU

IBM: Linux on System Z and HP-UX PA-RISC are On-Request Platforms for GI PSU 11.2.0.2.4

11.2.0.2 BP12 for Exadata Patch 13556724 See Section 3.1.3.3, “Oracle Database 11.2.0.2” Includes CPUJan2012 and 11.2.0.2.4 Database and Grid Infrastructure PSU fixes for Exadata
11.1.0.7.9 Database PSU Patch 13343461 See Section 3.1.3.4, “Oracle Database 11.1.0.7”
11.1.0.7.7 CRS PSU Patch 11724953 Released April 2011
10.2.0.5.5 Database PSU Patch 13343471 See Section 3.1.3.5, “Oracle Database 10.2.0.5”
10.2.0.5.2 CRS PSU Patch 9952245 Released January 2011 IBM: Linux on System Z, Solaris x86-64 and HP-UX PA-RISC are On-Request Platforms for CRS PSU 10.2.0.5.2
10.2.0.4.10 Database PSU Patch 12879929 See Section 3.1.3.6, “Oracle Database 10.2.0.4” Overlay PSU
10.2.0.4.4 Database PSU Patch 9352164 Released April 2010 Base PSU for 10.2.0.4.10
10.2.0.4.4 CRS PSU Patch 9294403 Released April 2010

 

在11gR2 当前最新版本11.2.0.3的第一个psu 11.2.0.3.1中修复了几十个bug:

 

CPU molecules in PSU 11.2.0.3.1:

PSU 11.2.0.3.1 contains the following new PSU 11.2.0.3.1 molecules:

13499128 – DB-11.2.0.3-MOLECULE-001-CPUJAN2012

13528551 – DB-11.2.0.3-MOLECULE-002-CPUJAN2012

Bug Fixes

See My Oracle Support Note 1340011.1 that documents all the non-security bugs fixed in each 11.2.0.2 Patch Set Update (PSU).

PSU 11.2.0.3.1 contains the following new fixes:

Automatic Storage Management

9703627 – 11.2.0.2: ROOT USE OF ASMCMD PLACES ALERT.LOG IN USER DIRECTORY

12620823 – SOL-SP64-11203:ASM INSTANCE HANG DURING CRS STACK STARTING ON THE SECOND NODE

12797765 – SOL_SP64: AFTER ALL DISKS FAILURE, DG CAN’T BE DISMOUNTED ON T2000-3

12905058 – REBOOT 2 CELL NODES, CHECKFILE FOUND CORRUPTION BLOCK IN 3 UNDO DATAFILES

12938841 – 11203_ASM_SOL_SP64:RACE BETWEEN ADD DISK AND DISMOUNT MAY CAUSE KFGUSENUM01

12950644 – RBAL HIT ORA-07445:[KFDGLOBALOPEN()+738], ASM INST ABORT

 

Generic

9873405 – ORA-600 DURING FAST REFRESH AFTER 11.2.0.1.0 TO 11.2.0.2.0 UPDATE.

 

High Availability

12718090 – LNX64-11203-RAC:DB FG RROC HIT ORA-00600[KCLCHKBLK_3]

12834027 – ORA-00600 [KJBMPRLST:SHADOW] & [KJBRASR:PKEY] IN A READ MOSTLY & SKIP LOCK ENV

12847466 – AROLTP-C: HANG SIGNATURE: ‘GC CURRENT REQUEST'<=’GC BUFFER BUSY ACQUIRE’

12861463 – RAC PERF: DEFAULT VALUE FOR _LM_SINGLE_INST_AFFINITY_LOCK SHOULD BE FALSE

12917230 – QUERY WITH TEMP TABLE TRANSFORMATION RUNS 5X SLOWER WAITING FOR REMASTERING

12998795 – AROLTP-C: HANG SIGNATURE: ‘GC CURRENT REQUEST'<=’GC BUFFER BUSY ACQUIRE’

13035804 – LACK OF DLM PSEUDO RECONFIGURATION TEXTUAL REASON

 

Oracle Space Management

13041324 – HCC ON ZFS AND PILLAR STORAGE

13492735 – DISALLOW ADDING NON-HCC DATAFILE TO HCC TABLESPACE

 

Oracle Virtual Operating System Services

13362079 – HCC SHOULD NOT BE ENABLED FOR NON ZFS/ PILLAR STORAGE ARRAY

关注dbDao.com的新浪微博

扫码关注dbDao.com 微信公众号:

Speak Your Mind

TEL/電話+86 13764045638
Email service@parnassusdata.com
QQ 47079569