Apply patch Java SE Critical Patch October 2011

Question

Hello,
Server: Red Hat 5 Enterprise Edition
java –version
java version "1.6.0_06"
Java(TM) SE Runtime Environment (build 1.6.0_06-b02)
Java HotSpot(TM) Client VM (build 10.0-b22, mixed mode, sharing)
According to Oracle information
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html#PatchTable
If I had JDK and JRE on my server, I should apply patch.
I don't know if at my server is JDK installed. Is this JDK: java version "1.6.0_06" ??
I know that JRE is installed: Java(TM) SE Runtime Environment (build 1.6.0_06-b02)
I'm planning to apply patch: JDK 6 Update 29. (https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1361232.1)
I downloaded zip file for Linux. Readme file says:
------------------------- Begin Of File -------------------------------
Bug Number: 9553040
Product Name: JavaSoft JDK 1.6.0_27-fcs-b07
Platform: Linux-i586
Bug Information:
Instructions for installing this patch:
1. Extract JDK provided in this patch.
2. Upgrade the JDK within the Application Server $OH per the instructions in
one of the following Notes:
Note 272808.1 -- 10.1.2
Note 396096.1 -- 10.1.3
Note 444462.1 -- 10.1.3 (upgrading to JDK6)
3. Upgrade the JDK within the Database $OH per the instructions in Note 418399.1
Note: This patch download also contains the standalone JRE install. Follow the Oracle product instructions for using the
standalone JRE. If there are questions on using the JDK or JRE with Oracle products, please contact the specific
product Support team accordingly.
Note: Release Notes for the JDK can be found here: http://www.oracle.com/technetwork/java/javase/releasenotes-136954.html
------------------------- End Of File -------------------------------
It is not clear how to update or patch JRE. Do I have to?
Should I install patch?
Please, help.

Answer 1

wolfeet wrote:
I'm in the same boat you are in. The wonderful world known as gov't IA vulnerabilities has identified the JDK within the database home as being a vulnerability and in need of a patch. If you are lucky enough to actually find the patch, the readme for the patch tells you to read another Note "3. Upgrade the JDK within the Database $OH per the instructions in Note 418399.1". Unfortunately that note is nowhere to be found. It's referenced a number of times if you search within oracle support, but it is missing. In the mean time an outstanding CAT I finding with multiple vulnerabilities is hanging over the environment.
No you're not. The thread is about upgrading Java as a standalone software product - that is no problem at all. What you are dealing with is the wisdom of Oracle to make a Java runtime an integral component of their DBMS (based upon your "JDK within the database" comment). In that context you should not be seeing the JDK as a standalone thing; there is only the Oracle DBMS, that it has a JDK built in is besides the point. Any security vulnerabilities there are, they are in the DBMS. The only security patches there are to apply are for the DBMS. Perhaps those security patches will also apply fixes to the built in JDK, who knows. You'd have to ask Oracle that.