Security experts accused Oracle of not paying attention to its flagship database software and underreporting the severity of a "fundamental" flaw.
Even
as Oracle fixed numerous flaws across multiple products in January's Critical
Patch Update, security experts criticized the company for the low number of
database fixes and claimed the company is downplaying the severity of a flaw in
its flagship relational database.
Only
two patches were for the Oracle Database out of the
78 security fixes in the
January update, which also covered the Oracle Fusion Middleware, Oracle
e-Business Suite, Oracle Supply Chain, Oracle PeopleSoft, Oracle JDEdwards,
Oracle Sun products, Oracle Virtualization and Oracle MySQL, the company said
in its CPU advisory released Jan. 17.
"Either
the database server has reached an amazing maturity in terms of security or
Oracle did not have enough resources to include more fixes into the
process," Amichai Shulman, CTO of Imperva, told
eWEEK.
As
Oracle expands its product portfolio and increases the total number of products
patched through the quarterly CPU, there appears to be a "bottleneck"
in Oracle's patching process, Shulman said. This CPU was the first time Oracle
included the open-source MySQL database, which it acquired in 2010 as part of
the Sun Microsystems acquisition.
While
MySQL accounted for a whopping 27 fixes, the overall number of vulnerabilities
in the CPU remained consistent with previous releases, according to Shulman.
"If you were to introduce a new product, there should be more
vulnerabilities in the CPU," he said.
The
low number of Oracle database fixes is most likely a sign of Oracle shifting
its focus and "de-emphasizing" the entire database line, Alex
Rothacker, director of security research at Application Security's TeamSHATTER,
told
eWEEK. Oracle has been
consistently decreasing the number of database-related fixes in its CPU since
January 2010, shortly after the Sun deal closed, he said. The company released
only 34 fixes for Oracle Database Server in all of 2011.
Of
the nine reported vulnerabilities TeamSHATTER has open with Oracle, several of
them are "at least as severe as those that were fixed in this CPU,"
Rothacker said.
Oracle
claimed there were fewer issues to fix in its software. The Oracle Database
Server code has "matured," and many of the vulnerabilities have been
weeded out, Eric Maurice, director of Oracle's security assurance program,
wrote in the
Oracle Software Security Assurance blog on Dec. 15.
Oracle
has also introduced a secure coding initiative, similar to Microsoft's Security
Development Lifecycle, which has resulted in fewer bugs in new code, according
to Maurice.
Email
Print
