Pete Finnigan's Oracle Security Weblog

I saw on Andrew Clarkes blog a post titled "Oracle Express Edition: Security Patching Policy" that refers to mark Townsend's reply to a thread on the OTN XE forum that says basically that Oracle will provided new versions of XE with security patches applied already rather than making patches available. I think this is a good decision. First to make security fixes available and secondly to make fixes available as a simple upgrade rather than as a patch. This is better as the amount of people who will download and use XE will liklely include a lot that are not Oracle experts. It will be easier for them to upgrade rather than patch. The thread is titled "Upgrade and Patch Policy" - you need to register to read it. I replied to Mark with these comments:

"Thanks for the good news on security "fixing" rather than patches. I can see that this would be a better solution for people out there who do not have a lot of Oracle skills. It will be far simpler to adopt an upgrade approach. Will the new patched versions be available on the same day as the current CPU releases? as not doing so would make XE versions targets for script based attacks. Reseachers or annonymous hackers are tending to release exploits quiote often straight after CPU releases.

Also will Oracle adopt a more reactive approach to fixing security bugs with XE as there will likely be more XE installations exposed to the Internet than with say production Enterprise databases?"

Good move!