Oracle Security in the News - Again
There is a lot of discussion lately about Oracle’s attention (or lack of attention) to security. In his blog, George Ou believes that Oracle is in denial about their security issues. On the 31st of August 2004, Oracle released a security update (Alert 68 info from Oracle) to address a large number of security flaws in their database server product. The patches had been a long time in coming even one of Oracle’s staunchest backers Lisa Vaas says that Oracle customers fully expected that these patches would actually fix the problems. Unfortunately this is not the case, and a lot of people’s secret information is being left unsecured because of this.In an open letter to Oracle, David Litchfield expresses his opinion on the patch set, and what is not included. And just last week Oracle security was again in the news when Joshua Wright of the SANS Institute and Dr Carlos Cid of the Information Security Group at the Royal Holloway, University of London published a paper stating that Oracle’s Password System makes it "straightforward" to recover user's password.
I know that no software is perfect, but I would hope that when a company is told that their software can leave user’s data vulnerable, that they would do everything in their power to fix the problems.
posted by DwaineRSnow @ 2:28 PM
<< Home