Skip to main content
Tag

oracle

|||||

Who Are the Worst Vendors of 2019?

By News, Patch ManagementNo Comments

Who Are the Worst Vendors of 2019?

From the highest number of software updates to highest number of critical vulnerabilities, find out which vendors are the worst offenders.

2019 has brought serious threats causing massive disruption and data theft. Which vendor has released the most software updates and fixes in 2019, and of these, which updates are the most critical? Let’s find out!

The top 20 vendors look like this for 2019—this means Microsoft has released the most patches to fix a vulnerability of any severity out of the most popular software vendors.

Let’s see how the top 10 from this list compare when we deep dive into the severity of the vulnerabilities fixed. For simplicity, we will base our statistics on the CVSS Score.

What is a CVSS Score?

The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help properly assess and prioritize their vulnerability management processes.

We can see that Microsoft have released a total of 6330 patches so far this year, with 2143 of these patches resolving a vulnerability with a CVSS score of 9 or higher. Just behind Microsoft in second place is Adobe – which has released 2052 updates.

Let’s take a look at how the most serious vulnerabilities impact the original ranking. We can see from the table below that the top 5 vendors have made significant movements and some are unexpected, e.g. IBM has moved out of the top 5 and Adobe has moved into the top 5.

Who’s the worst?

To continue this trend analysis review and to find out who has fixed the highest number of critical vulnerabilities, let’s compare the percentage of those threats against the total number of patches they have released this year.

We can do this by dividing all vulnerabilities with CVSS score more than 9 and dividing by the total number released by 100. The following table shows the new ranking of the vendors against the original ranking.

Robert Brown, Director of Services said, “What is really surprising is that a third party vendor to Microsoft has fixed more high priority vulnerabilities than them. If you do not have a strategy to include third party updates believing that only Microsoft needs to be patched, I hope this table convinces you to implement a different, more inclusive process. Not only that, some of these third party vendors like Oracle and Cisco are less likely to appear in a patching strategy which would expose a lot of your estate. Lastly, the toolset you use to patch your environment should be flexible to include other non-Windows operating systems like RedHat and Suse.”

Start a Free Trial

Try Syxsense today and start patching your IT environment with a powerful and easy-to-use IT management toolset.
Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
||

Oracle Drops Critical Update Bomb

By News, Patch ManagementNo Comments

Over 300 Vulnerabilities: 49 Rated as Critical

Oracle has just dropped its October 2018 update and it is a big one! Over 300 security flaws are addressed in this massive release. 49 of those flaws carry a critical CVSS rating (9 or higher).

One of these scored a ‘perfect’ critical rating of 10!

The flaw in question is CVE-2018-2913 for Oracle GoldenGate. According to Oracle’s Advisory, the flaw “may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.”

Of the remaining critical flaws, 45 have a CVSS rating of 9.8. This release is tackling a huge group of major vulnerabilities. Any organization running Oracle products should immediately scan their networks to figure out just how many devices require these updates.

Simplify Patch Management Tasks

If you want to make the patch management process more efficient, look to an IT solution such as Syxsense. The inventory scan feature can be set to regularly check your network and then display that information in easy to understand icons and graphs.

Then, move to the Patch Manager feature to set up a task to remediate the now obvious vulnerabilities. A task will be prepopulated for rapid deployment, or there are a multitude of controls to facilitate the update release strategy that works best for your unique environment.

Massive update bombs don’t have to wreak havoc on your work week. Discover a better way to manage your updates with Syxsense.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
||||||

Severe Oracle Vulnerabilities

By NewsNo Comments

WebLogic Server Needs Immediate Patching

If you are using an Oracle WebLogic Server in your environment, you must patch it now.

This easily exploitable vulnerability allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.

Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. To compound this further, it is currently being exploited and has been assigned a CVSS score of 9.8 out of 10.

More Oracle Updates

Oracle has released its July 2018 updates to address a total of 334 security vulnerabilities, the largest number of flaws resolved with a Critical Patch Update (CPU) to date. Over 200 of the bugs may be remotely exploitable without authentication.

Robert Brown, Director of Services for Verismic said, “IT Managers are so focused on patching Windows, that they lose focus on the applications within their environment which can be exploited just as easy as the OS.”

Your patching strategy should accommodate all weaknesses. This includes the applications used within your environment.

All Oracle customers are advised to apply the fixes included in Oracle’s Critical Patch Updates without delay, as some of the addressed vulnerabilities are being targeted by malicious actors in live attacks.

I am text block. Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

[vc_separator]

I am text block. Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.