Feeds

Oracle in war of words with security researcher

'What David Litchfield has done is put our customers at risk'

The Power of One eBook: Top reasons to choose HP BladeSystem

ARLINGTON, Virginia - A security researcher released details of a critical flaw in Oracle's application and Web software on Wednesday, criticising the company for not cooperating with the security community and taking too long to fix software issues that threaten its customers.

The flaw occurs in the way that a module in Oracle's Apache Web server distribution handles input and could give external attackers the ability to take control of a backend Oracle database through the Web server, said David Litchfield, principal researcher of database security firm Next-Generation Security Software, during a presentation at the Black Hat Federal security conference.

The database company should have fixed the issue in the latest critical patch update (CPU), but failed to do so, he said, adding that he believes the flaw is more significant than a privilege escalation issue fixed in less than three months by Oracle in the latest update.

"Oracle missed an opportunity to fix this issue," Litchfield said. "Hopefully, they will do it now."

After hearing about the conference presentation, Oracle slammed the researcher for releasing information about the vulnerability, saying that doing so puts its customers in danger.

"We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available," Duncan Harris, senior director of security assurance for Oracle, said in an interview with SecurityFocus. "What David Litchfield has done is put our customers at risk."

The war of words is the latest battle over the perception that software makers have been slow to respond to vulnerabilities or that researchers irresponsibly release information about a critical flaw.

Last year, NGSSoftware published details of several vulnerabilities in Sybase's database software after the company relented in legal threats against the researcher. At the Black Hat Security Briefings in Las Vegas last summer, networking giant Cisco and network protection firm Internet Security Systems filed suit against a security researcher for disclosing methods to run code on Cisco's networking hardware.

Oracle has taken a significant amount of criticism for its handling of software security issues. Last week, the database giant released a critical patch update (CPU) that fixed at least 82 flaws. Two of the flaws apparently took more than 800 days to fix. That's nothing new - last year, researchers took the company to task for taking more than 650 days to publish a fix for a security issue.

"They are one of the slowest to get things patched," he said. "It is astonishing how backwards they are in terms of fixing security issues.

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.