7 Ways Oracle Puts Database Customers At Risk

[InfoSec News <alerts () infosecnews org>]

http://www.darkreading.com/database-security/167901020/security/news/232901381/7-ways-oracle-puts-database-customers-at-risk.html

By Ericka Chickowski
Contributing Writer
Dark Reading
May 02, 2012

Last week Oracle bumped heads with the database security community in a 
communications blunder that caused a proof of concept to be released for 
an unpatched four-year-old vulnerability in the database's TNS Listener 
service. This week Oracle released a workaround, but still no patch, 
reigniting critics' claims that the company is neglecting its database 
customers with shoddy patching practices.

Security professionals believe that Oracle is hurting its database 
customers through security negligence. Here are their charges. Dark 
Reading did try to contact Oracle for this article, but the company did 
not respond to inquiries.


1. Failing to play nice with researchers

According to security researcher Joxean Koret, the events that unfolded 
around the TNS Poison vulnerability are emblematic of Oracle's 
relationship with the research community and its customers. The drama 
started when the company credited Koret for a hand in its Critical Patch 
Update and told him in a separate email exchange that it had fixed a 
vulnerability he disclosed to the company in 2008.

"Oracle said the vulnerability was fixed. I decided to publish details 
about the vulnerability, fully believing it was fixed; so far, so good," 
Koret told Dark Reading. "Then it turned out the vulnerability wasn't 
fixed at all and there was no patch because, they said: "the 
vulnerability was fixed in later versions"."

[...]


_______________________________________________
LayerOne Security Conference
May 26-27, Clarion Hotel, Anaheim, CA
http://www.layerone.org