[Previous entry: "More than 275 new security bugs found last week in the Oracle 10g database"] [Next entry: "Commercial rainbow cracking"]
Oracle XE will get upgrades with security fixes rather than patches
November 11th, 2005 by Pete
Post to del.icio.us
Post to Furl
I saw on Andrew Clarkes blog a post titled "Oracle Express Edition: Security Patching Policy" that refers to mark Townsend's reply to a thread on the OTN XE forum that says basically that Oracle will provided new versions of XE with security patches applied already rather than making patches available. I think this is a good decision. First to make security fixes available and secondly to make fixes available as a simple upgrade rather than as a patch. This is better as the amount of people who will download and use XE will liklely include a lot that are not Oracle experts. It will be easier for them to upgrade rather than patch. The thread is titled "Upgrade and Patch Policy" - you need to register to read it. I replied to Mark with these comments:
"Thanks for the good news on security "fixing" rather than patches. I can see that this would be a better solution for people out there who do not have a lot of Oracle skills. It will be far simpler to adopt an upgrade approach. Will the new patched versions be available on the same day as the current CPU releases? as not doing so would make XE versions targets for script based attacks. Reseachers or annonymous hackers are tending to release exploits quiote often straight after CPU releases.
Also will Oracle adopt a more reactive approach to fixing security bugs with XE as there will likely be more XE installations exposed to the Internet than with say production Enterprise databases?"
Good move!
