Oracle Still Sitting on Database-Security PatchesBy Lisa Vaas | Posted 2004-08-17 Email Print
Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce
The company for weeks has kept a stony silence on a release date for patches fixing flaws it has known about since winter.Oracle Corp. is in public-relations hot water after weeks of stony silence on its delay in releasing 34 security vulnerabilities patches for flaws it has known about since January or February.
"Clearly, it's a good thing that they're getting the patches ready, but it seems to me that Microsoft [Corp.] has gotten a lot of grief for delaying patches for a variety of reasons," reads one post on the Weblog .net DElirium. "Will Oracle be held to the same standard?"
The flaws were discovered in January by David Litchfield, managing director of Next Generation Security Software Ltd., in Surrey, England. According to Litchfield, the flaws include buffer overflow attacks and SQL injection techniques for gaining access to Oracle databases.
In light of Microsoft's recurring security woes and the criticism that has steadily rained down upon it, some are itching to see Oracle get its share of the griefparticularly in light of its "Unbreakable" database ad campaign.
But as experts and one blog writer suggested, the security situation in general for Oracle databases is a far cry from Microsoft Windows. "If you use Oracle, your [database] will be for sure behind dozens of firewalls, servers, etc.," wrote one blog contributor.
"Different from [Microsoft SQL Server instances] that are very often used for Web and installed on the same machine as the Web server. The risks involved on an Oracle update and a Windows update are very different."
Ian Abramson, chief technology officer at Toronto-based Red Sky Data Inc., agreed with that premise. "Most installations we have are pretty secure to the outside world nowadays," he said.
John Pescatore, an analyst at Gartner Inc., said the skill sets of Oracle DBAs (database administrators) also tend to be higher than those of the population of professionals who run Microsoft's SQL Server databases, which have the reputation of being far simpler to manage. "Oracle databases tend to be behind firewalls and protected by [people with] a much more sophisticated set of skills," he said.
In the meantime, rumors are flying that Oracle is delaying the patches release while it constructs a new patch-delivery paradigmspecifically, a cumulative, monthly patch-release schedule a la Microsoft's current strategy.
Pescatore counts Microsoft as a client and advised the company on its initial adoption of the cumulative patch-release program. He said the move helped enterprises because it made patch releases more "predictable and packaged up."
"A lot of other large, Oracle-sized software companies have waited and watched to see how it went with Microsoft, to see if they'd get roasted, to see if they looked like they were trying to hide vulnerabilities," Pescatore said. "We [had] advised Microsoft that we thought it would help enterprises. [Before the cumulative patch program], you hadn't even finished one patch when they said they had another."
Oracle's delayed flaw fixes come at a crucial time, coinciding with Microsoft's release of SP2 (Service Pack 2) for Windows XP, which has been shown to break about 50 applications upon installation. As such, some have sought to compare the two companies' approach to patch delivery.
But that comparison is weak, Pescatore said, considering that SP2 is mostly breaking applications that are doing "bad things."
"Two things are breaking applications," he said. "[Applications that have the] Windows firewall on by default, and Microsoft made a lot of changes in how Windows handled remote procedure calls, forcing them to be authenticated.
"So, the firewall is sort of forcing applications to work in a more secure way," he said. "That's breaking some of themmostly gaming and things that try to communicate on the Internet. And remote procedure callssloppy programming done in Windows that was taken advantage of by programmers."
Some Oracle users said they'd welcome a shift to a monthly patch-release schedule. "That seems to me to be the best of both worlds," said Kelly Cox, an Oracle DBA who runs a small consultancy in Alexandria, Va. "With [a monthly release], you still need to wait a little bit, but at least they'll bundle it. The only problem is waiting for that [once-a-month date]."