July 19, 2005 6:04 PM PDT

Oracle dragging heels on unfixed flaws, researcher says

Related Stories

Oracle update fixes security flaws

July 13, 2005
Serious unpatched security flaws exist in certain Oracle products, according to a German security researcher who said the software maker has not fixed the bugs despite knowing about them for two years.

Alexander Kornbrust of Red Database Security published alerts on six security vulnerabilities on Tuesday. Five of the reported bugs are in the Oracle Reports enterprise reporting tool. Another is in Oracle Forms, a technology that is part of Oracle Developer Suite and is used to build applications.

"I reported these bugs two years ago," Kornbrust said in an e-mail to CNET News.com. In April, to pressure the company into providing fixes, he told the software maker that he would publish details on the bugs if they were not patched as part of the company's July security bulletin.

The most serious vulnerabilities could let an attacker gain control over an Oracle user's systems, according to the alerts. Kornbrust deems three of the bugs "high risk," two "medium risk" and one "low risk." The problems affect various versions of the Oracle products, including the newest 10g versions, he said.

Oracle declined to comment on Kornbrust's report of the flaws. A company representative did say that Oracle believes details on vulnerabilities should not be disclosed before a patch is available.

"We are disappointed when researchers act contrary to this industry best practice," the representative said in an e-mailed statement.

Kornbrust is a respected researcher, security experts from VeriSign's iDefense and eEye Digital Security said. He has discovered bugs in Oracle products in the past and those have been fixed by the software maker, they said.

Public disclosure of flaws turns up the heat on Oracle to remedy the problems but also increases the risk of attacks, said Steve Manzuik, a product manager at eEye. "It gives other people the spot to look to find the actual problems," he said.

The time that Kornbrust claims Oracle has left the vulnerabilities unpatched is "phenomenal," said Michael Sutton, a lab director at iDefense. "If true, this is one of the worst examples that I've seen of a software vendor not responsibly addressing known vulnerabilities. I'm hopeful that Oracle will publicly respond to this allegation as customers deserve an explanation," Sutton said.

eEye's Manzuik agreed. "You don't even see that with the longest Microsoft vulnerability," he said. There must have been some sort of miscommunication between Oracle and Kornbrust, he suggested.

Kornbrust believes Oracle could be playing for time. "It is easier to fix the bug silently in the next release and to wait until an old product is no longer supported," he said.

Pete Finnigan, a security specialist in York, England, said there may be as much as 250 reported but unfixed flaws in Oracle products. "Maybe they simply have not enough security people in-house to fix the bugs," he said.

Kornbrust said that he is not aware of anyone exploiting the flaws. He has offered workarounds in his advisories to protect systems. Finnigan and eEye's Manzuik recommend users apply those, after making sure the workarounds don't break their systems.

2 comments

Join the conversation!
Add your comment
Obscuro Security says: huge flaws to fix; be sure to spell our name right.
Even the public no longer cares about the random security firms (who don't seem to get together on anything - funny, isn't it?) making proclamations on what needs to be "fixed" and what doesn't.

Maybe CNet should do a story on the security firms themselves. Of course, that would require research, instead of merely reprinting press releases.
Posted by M C (598 comments )
Reply Link Flag
Obscuro Security says: huge flaws to fix; be sure to spell our name right.
Even the public no longer cares about the random security firms (who don't seem to get together on anything - funny, isn't it?) making proclamations on what needs to be "fixed" and what doesn't.

Maybe CNet should do a story on the security firms themselves. Of course, that would require research, instead of merely reprinting press releases.
Posted by M C (598 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.