Call: +44 (0)7759 277220 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Sun has released an alert notification (15 July 2005) about multiple security vulnerabilities in Oracle affecting SunMC"] [Next entry: "Security experts round on Oracle over unpatched holes"]

Oracle dragging heels on unfixed flaws, researcher says

Following on from Red Database Security's announcement yesterday of six security bugs in Oracle's products that have not been fixed is a news article about this by Joris Evers of CNET. The article is titled "Oracle dragging heels on unfixed flaws, researcher says".

The article starts by saying that Oracle has some serious un-patched flaws in its software that they have known about for about two years. The article includes a conversation with Alex Kornbrust who revealed the bugs to the world. Alex talks about the seriousness of the bugs and also how he tried to pressure Oracle into releasing fixes. Oracle did not comment on the release but said it believes that details of bugs should not be revealed until patches are available. A spokesperson said:

"We are disappointed when researchers act contrary to this industry best practice"

Joris also interviewed Steve Manzuic of Eeye Digital Security and also Michael Sutton of iDefense. Joris also interviewed me about this release and I am quoted as well (I have updated my in-the-news section to include links to this article)

Alex found a lack of response from Oracle on fixing these bugs. I asked him this morning about Oracle's spokesman's response in this news article and he said:

"Oracle should know it better. They are a core member of OIS. The OIS suggests to send status updates every week."

Again as I said yesterday anyone using Forms or Reports is advised to follow Alex's workarounds.