Home >> Security

Oracle patching fewer database flaws, says researcher

By: Jaikumar Vijayan On: 20 Jan 2011 For: ComputerWorld (US) Creator

Researchers say increased emphasis on acquired products makes it harder for Oracle to stay on top of database flaws

Oracle Corp.'s ability to address vulnerabilities in its core database technologies may be hampered by the vast number of products the company now must manage, security experts say.

For example, the list of Oracle's quarterly security updates released Tuesday includes only six patches for security flaws in the company's flagship database products. The other 60 patches released fix bugs in Oracle's Fusion middleware technologies, its supply chain and CRM software and products gained from its acquisition of Sun Microsystems early last year.

The small number of database patches doesn't necessarily mean that the Oracle technology is becoming more secure, said Alex Rothacker, director of security at Application Security Inc.'s Team Shatter vulnerability assessment group.

Rather, it likely shows that the company doesn't have the capacity to fix the full list of Oracle database flaws reported to it in a timely fashion, said Rothacker, whose team of researchers discovered three of the six database flaws addressed in this week's update.

Several other similar flaws have been reported to Oracle by AppSec, but have not been fixed yet, Rothacker said. In some cases, the unpatched vulnerabilities were reported to Oracle several months ago, he added.

"The number of database fixes from Oracle has really gone down," he said. "But that's not because of a lack of vulnerabilities to fix. They have apparently reassigned their priorities and are choosing not to fix all the database vulnerabilities that are reported to them. It appears that they are losing some of the DBMS focus and are getting spread too thin on other stuff."

Oracle did not respond to a request for comment on the reason for releasing six database patches.

The release of six database patches, compared to nine in the October, 2010, security update, continues a trend that began early last year after the acquisition of Sun, said Amichai Shulman, chief technology officer at database security vendor Imperva.

In all of 2010, Oracle issued patches for 32 database flaws, compared to 54 in 2009, 53 in 2008 and over 70 in 2007.

"There is some bottleneck in their vulnerability patching process that is preventing them from getting back to the pace of fixing [database flaws] that they had a few years ago," Shulman said. "Something about the incorporation of so many different products from so many different vendors, especially Sun, has caused some sort of a problem that doesn't allow them to fix more vulnerabilities each cycle."

According to Shulman, some security researchers who have submitted notice of several vulnerabilities to Oracle are waiting to hear back from the company. "I really would like to think that they are getting better with their product, but honestly, that's not it," he said.

Stephen Kost, chief technology officer at security vendor Integrigy, noted that IT managers must also deal with Oracle's continuing reluctance to release full details of the flaws it is patching. Unlike Microsoft and other vendors, which release detailed information on each flaw and their patches, Oracle simply releases patches and offers little data on the flaws.

"One piece of information that Oracle does not release is what should be tested when I apply the patch," Kost said. "What should I be testing from a functional perspective; what might I break? Right now I don't know,"

According to Kost, while most of the flaws in Oracle's core database may have been addressed in recent security updates, the number of flaws in ancillary technologies such as Oracle Database Vault and Oracle Audit Vault are not quickly patched. "Products that are supporting the Oracle database are the places where you find problems. That doesn't lessen the risk," but just moves it to another place, he said.

Sign up for our Newsletters

Tags: Oracle

Close X

Your Name:

Your E-mail:

Friend's Name:

Friend's E-mail:

Close X

| Views: 1823 | Rating:

(0 votes)

Rate this article on a scale of
1 to 5 stars,5 being the best.

Close X

Page 1

Quick Access

Video Conferencing Cloud Computing Resource Centre CIO Canada's Brainstorm Centre CIO Canada Debate IdeaCity Conference June 18-20 - Toronto

Jaikumar Vijayan is a contributor to the International Data Group (IDG) News Service, which publishes global technology stories from bureaus around the world to more than 300 publications in more than 60 countries.

Recent Canadian IT Jobs

more: IT Jobs , Post A Job

blog comments powered by Disqus

Related Videos

Building an Enterprise IT Security Training Program

Building an Enterprise IT Security Training ProgramOver 50% of security breaches are a result of end-user error, oversight, and ignorance. IT security training is an effective method of reducing end-user related security breaches.

Cloud Computing: Extending the Network (3 of 3)

Cloud Computing: Extending the Network (3 of 3)The end goals of private cloud computing are to; Enable efficient delivery of IT resources and services; Give the enterprise complete control over data; Enable choice in technologies and service providers

Cloud Computing: Getting to One Network (1 of 3)

Cloud Computing: Getting to One Network (1 of 3)In this first video of the series, the team will take you through how to consolidate the different types of traffic onto a single, general-purpose, high-performance, highly available network that greatly simplifies the network infrastructure and redu

Cloud Computing: The Unified Compute Model (2 of 3)

Cloud Computing: The Unified Compute Model (2 of 3)In this second video, the team will look at how to unite computing, networking, storage access, and virtualization into a single cohesive system. The Unified Compute model prepares you for cloud computing. This will be discussed in the next and fin

Professors warn of arms race in cyberspace

Professors warn of arms race in cyberspaceAt a panel discussion organized by Osgoode Hall, professors Ronald Deibert and Stephane Leman-Langlois discussed the attacks on Google Inc. and the challenges of working in countries such as China.

Computing Canada Poll

Read the Computing Canada articles you made happen.

• Democratizing Business Continuity
• Agility and efficiency through virtual switching

* Sponsored by Microsoft

Related White Papers

Getting a better grip on mobile devices - IBM Software provides solutions and strategies for managing both employee-owned and enterprise-owned equipment.

2012 Bit9 Cyber Security Research Report - The 2012 Bit9 Cyber Security Research Report presents the perspectives of more than 1,800 IT professionals on the world of advanced cyber threats.

Realistic Security, Realistically Deployed: Today's Application Control and Whitelisting - With today's sophisticated and constant barrage of cyber-threats defenses focused on a blacklist "permit-all-except" philosophy are doomed to fail. Modern security requires an application control and whitelisting approach.

Advanced Threat Landscape: What Organizations Need to Know - Combating today's cyber-threats requires an approach based on trust, not the blacklisting security strategies of the past.

IFCG Addresses Privacy and Data Security in a Regulated Industry Through a Managed Security Services Provider - IFCG turned to No Panic Computing (NPC) to provide security-hardened laptops, monitored and managed 24/7, boasting biometric access, encrypted hard drives, sophisticated anti-virus monitoring and an OS optimized for performance and data protection.

more: White Papers