Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity
    • Database
    • Networking

    Customers Wait for Oracle Security Patches

    By
    Ryan Naraine
    -
    May 4, 2006
    Share
    Facebook
    Twitter
    Linkedin

      Just call it Oracles May critical patch update.

      Three weeks after the database server vendor announced the release of its April 2006 CPU, customers are still waiting for the several important fixes.

      The update, which addresses 36 different product flaws, is still undergoing quality assurance testing and is not yet available for download.

      On April 18, when the scheduled quarterly update was released, Oracle said the patches would be ready for download on May 1.

      Now, according to information posted on the companys Metalink portal, some of the patches wont be ready until May 15.

      Oracle declined a request for an interview to discuss the delay, which is being blamed on ongoing patch quality testing. A promised statement was not available at the time this article was published.

      Alexander Kornbrust, founder and CEO of Red-Database-Security, said the absence of the patches a full month after the scheduled release date points to a resource problem at the Redwood City, Calif., vendor.

      “Its very normal for Oracle to release all the patches for all platforms, but this month its been extreme. This defeats the purpose of having a scheduled release cycle,” Kornbrust said in an interview with eWEEK.

      Kornbrust, who regularly reports database and server flaws to Oracle, said the purpose of implementing a rigid patch release cycle is to help DBAs prepare for patch testing and deployment.

      “If these DBAs now have to wait weeks and months for the patches, whats the use of having an Oracle patch day?” he asked.

      Cesar Cerrudo, founder and CEO of Argeniss Information Security, said patches for Oracle database versions 8.1.7.4, 10.1.0.4, 10.1.0.5 and 10.2.0.2 are among those that are not yet available.

      Ziff Davis Media eSeminars invite: Join us on May 8 at 2 p.m. ET as security and identity management experts and Sun Microsystems look at how identity management provisioning can help lower TCO and realize ROI payback.

      “Oracle promised them on May 1. Now they are saying some will come on May 10 and others will come on May 15. Its clear they are having big problems,” Cerrudo said.

      He said Oracles explanation that patch testing is not yet done points to serious shortcomings and an absence of a good patch development process.

      “For such a big organization with a lot of financial resources, they should be ready to handle this without problems. But they are amateurs on everything security related,” Cerrudo said.

      “They spend a lot of time creating these patches. Then, patch day comes around and the patches arent available. Then, when the patches are finally released, its normal to find that they are incomplete and fail to address the actual vulnerability,” he added.

      Aaron Newman, database security expert, chief technology officer and co-founder of Application Security, said Oracle customers must start demanding better security practices.

      “These arent random complaints from unhappy researchers,” Newman said, referring to the comments from Kornbrust and Cerrudo. “They need to admit their procedures arent working and seek help getting it fixed.”

      David Litchfield, co-founder of British database security outfit Next Generation Security Software, believes Oracle should invest more resources into its patch creation and quality assurance processes.

      “[They] should expend more effort on securing extant code in preference to writing new code [and] rework their security tools,” Litchfield said in an e-mail interview.

      “Researchers have proved that Oracles code scanning tools have failed to a large extent—now Oracle should work out why and change the tools accordingly,” he added.

      Lisa Vaas contributed to this report.

      Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

      Ryan Naraine
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×