http://www.eweek.com/article2/0,1759,1637212,00.asp By Lisa Vaas August 17, 2004 Oracle Corp. is in public-relations hot water after weeks of stony silence on its delay in releasing 34 security vulnerabilities patches for flaws it has known about since January or February. "Clearly, it's a good thing that they're getting the patches ready, but it seems to me that Microsoft [Corp.] has gotten a lot of grief for delaying patches for a variety of reasons," reads one post on the Weblog .net DElirium. "Will Oracle be held to the same standard?" The flaws were discovered in January by David Litchfield, managing director of Next Generation Security Software Ltd., in Surrey, England. According to Litchfield, the flaws include buffer overflow attacks and SQL injection techniques for gaining access to Oracle databases. Litchfield has demurred on giving further details of the flaws, not wanting to enable hackers to commit exploits before Oracle has released patches. He first mentioned the flaws at the BlackHat security conference in Las Vegas last month, saying he had expected Oracle to deliver the patches in time for that conference. Oracle has confirmed that the flaws do exist and that it has already created fixes, but the Redwood Shores, Calif., database giant has not offered details on when patches would be available. In light of Microsoft's recurring security woes and the criticism that has steadily rained down upon it, some are itching to see Oracle get its share of the grief - particularly in light of its "Unbreakable" database ad campaign. But as experts and one blog writer suggested, the security situation in general for Oracle databases is a far cry from Microsoft Windows. "If you use Oracle, your [database] will be for sure behind dozens of firewalls, servers, etc.," wrote one blog contributor. "Different from [Microsoft SQL Server instances] that are very often used for Web and installed on the same machine as the Web server. The risks involved on an Oracle update and a Windows update are very different." Ian Abramson, chief technology officer at Toronto-based Red Sky Data Inc., agreed with that premise. "Most installations we have are pretty secure to the outside world nowadays," he said. John Pescatore, an analyst at Gartner Inc., said the skill sets of Oracle DBAs (database administrators) also tend to be higher than those of the population of professionals who run Microsoft's SQL Server databases, which have the reputation of being far simpler to manage. "Oracle databases tend to be behind firewalls and protected by [people with] a much more sophisticated set of skills," he said. In the meantime, rumors are flying that Oracle is delaying the patches release while it constructs a new patch-delivery paradigm—specifically, a cumulative, monthly patch-release schedule a la Microsoft's current strategy. Pescatore counts Microsoft as a client and advised the company on its initial adoption of the cumulative patch-release program. He said the move helped enterprises because it made patch releases more "predictable and packaged up." "A lot of other large, Oracle-sized software companies have waited and watched to see how it went with Microsoft, to see if they'd get roasted, to see if they looked like they were trying to hide vulnerabilities," Pescatore said. "We [had] advised Microsoft that we thought it would help enterprises. [Before the cumulative patch program], you hadn't even finished one patch when they said they had another." Oracle's delayed flaw fixes come at a crucial time, coinciding with Microsoft's release of SP2 (Service Pack 2) for Windows XP, which has been shown to break about 50 applications upon installation. As such, some have sought to compare the two companies' approach to patch delivery. But that comparison is weak, Pescatore said, considering that SP2 is mostly breaking applications that are doing "bad things." "Two things are breaking applications," he said. "[Applications that have the] Windows firewall on by default, and Microsoft made a lot of changes in how Windows handled remote procedure calls, forcing them to be authenticated. "So, the firewall is sort of forcing applications to work in a more secure way," he said. "That's breaking some of them—mostly gaming and things that try to communicate on the Internet. And remote procedure calls - sloppy programming done in Windows that was taken advantage of by programmers." Some Oracle users said they'd welcome a shift to a monthly patch-release schedule. "That seems to me to be the best of both worlds," said Kelly Cox, an Oracle DBA who runs a small consultancy in Alexandria, Va. "With [a monthly release], you still need to wait a little bit, but at least they'll bundle it. The only problem is waiting for that [once-a-month date]." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Wed Aug 18 2004 - 06:09:58 PDT