Feeds

Oracle in war of words with security researcher

'What David Litchfield has done is put our customers at risk'

Top 5 reasons to deploy VMware with Tegile

ARLINGTON, Virginia - A security researcher released details of a critical flaw in Oracle's application and Web software on Wednesday, criticising the company for not cooperating with the security community and taking too long to fix software issues that threaten its customers.

The flaw occurs in the way that a module in Oracle's Apache Web server distribution handles input and could give external attackers the ability to take control of a backend Oracle database through the Web server, said David Litchfield, principal researcher of database security firm Next-Generation Security Software, during a presentation at the Black Hat Federal security conference.

The database company should have fixed the issue in the latest critical patch update (CPU), but failed to do so, he said, adding that he believes the flaw is more significant than a privilege escalation issue fixed in less than three months by Oracle in the latest update.

"Oracle missed an opportunity to fix this issue," Litchfield said. "Hopefully, they will do it now."

After hearing about the conference presentation, Oracle slammed the researcher for releasing information about the vulnerability, saying that doing so puts its customers in danger.

"We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available," Duncan Harris, senior director of security assurance for Oracle, said in an interview with SecurityFocus. "What David Litchfield has done is put our customers at risk."

The war of words is the latest battle over the perception that software makers have been slow to respond to vulnerabilities or that researchers irresponsibly release information about a critical flaw.

Last year, NGSSoftware published details of several vulnerabilities in Sybase's database software after the company relented in legal threats against the researcher. At the Black Hat Security Briefings in Las Vegas last summer, networking giant Cisco and network protection firm Internet Security Systems filed suit against a security researcher for disclosing methods to run code on Cisco's networking hardware.

Oracle has taken a significant amount of criticism for its handling of software security issues. Last week, the database giant released a critical patch update (CPU) that fixed at least 82 flaws. Two of the flaws apparently took more than 800 days to fix. That's nothing new - last year, researchers took the company to task for taking more than 650 days to publish a fix for a security issue.

"They are one of the slowest to get things patched," he said. "It is astonishing how backwards they are in terms of fixing security issues.

Remote control for virtualized desktops

More from The Register

next story
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.