# MA-385.042014: MyCERT Advisory - Oracle Critical Patch Update for April 2014

**Date:** 17 Apr 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-385.042014  
**Advisory ID:** MA-385.042014

---

**1.0 Introduction**
Oracle has released its Critical Patch Update for April 2014 to address 104 vulnerabilities across multiple products. Customers are strongly recommended to apply CPU fixes as soon as possible. A CPU is a collection of patches for multiple security vulnerabilities.
**2.0 Impact**
This Critical Patch Update provided fixes for 104 new security vulnerabilities across a wide range of product families.
The April 2014 Critical Patch Update provided:
- 2 for the Oracle Database
- 20 for Oracle Fusion Middleware
- 3 for Oracle Hyperion
- 10 for Oracle Supply Chain Products Suite
- 8 for Oracle PeopleSoft Products
- 1 for Oracle Siebel CRM
- 1 for Oracle iLearning
- 37 for Oracle Java SE
- 3 for Oracle and Sun Systems Products Suite
- 5 for Oracle Virtualization
- 14 for Oracle MySQL
Due to possible successful attacks, Administrators are strongly recommended to apply the new security fixes as soon as possible because it includes fixes for a number of severe vulnerabilities.
**3.0 Affected Products**
Below is the details list of critical patch update for Oracle product:
- Oracle Database Server
- Oracle Fusion Middleware
- Oracle Hyperion
- Oracle Fusion Application
- Oracle E-Business Suite
- Oracle Supply Chain Products Suite
- Oracle PeopleSoft Enterprise
- Oracle Siebel CRM
- Oracle iLearning
- Oracle Java SE
- Oracle and Sun Systems Products Suite
- Oracle Linux and Virtualization
- Oracle MySQL
**4.0 Workaround**
Due to the criticality of applying the new security fixes, Administrators are advised to apply the fixes as soon as possible to correct the problems. However, until the fixes are applied, Administrators may consider the below workarounds to reduce possible successful attacks:
- Restrict network protocols required by an attack
- For attacks that require certain privileges or access to certain packages, remove the privileges or the ability to access the packages from unprivileged users
The above workarounds may break application functionality, so Administrators are strongly recommended to test changes on non-production systems first.
Please take note that the above workarounds are only temporary solution measures. Security fixes must be applied to correct the underlying problem permanently.
**5.0 Recommendation**
Oracle has released a security update for these issues. Users are highly encouraged to download the most recent release to address these vulnerabilities. Update can be obtained from:
- Oracle Critical Patch Update April 2014 Documentation Map, [My Oracle Support Note 1637289.1](https://support.oracle.com/rs?type=doc&id=1637289.1).
- [Patch Availability Table](http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#PIN) to access the documentation for those patches.
- Developers can download the latest release from <http://www.oracle.com>.
- Users running Java SE with a browser can download the latest release from <http://java.com/en/download/installed.jsp>. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.
- Supported Database, Fusion Middleware, Oracle Enterprise Manager Base Platform (formerly "Oracle Enterprise Manager Grid Control") and Collaboration Suite products are patched in accordance with the Software Error Correction Support Policy explained in [My Oracle Support Note 209768.1](https://support.oracle.com/rs?type=doc&id=209768.1).
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#b5d6ccd7d0c78c8c8cf5d6ccd7d0c7c6d0d6c0c7dcc1cc9bd8cc) or [[email protected]](/cdn-cgi/l/email-protection#6f02160c0a1d1b2f02160c0a1d1b41001d08410216)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
**6.0 References**
- <http://www.us-cert.gov/ncas/current-activity/2014/04/16/Oracle-Releases-April-2014-Security-Advisory>
- <https://blogs.oracle.com/PortalsProactive/entry/oracle_critical_patch_update_for>
- <http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#PIN>
- <http://www.zdnet.com/oracle-issues-critical-patch-update-104-security-fixes-7000028496/>