Sheila Jenkins Oracle News Headlines

More on Oracle Security Holes
August 30, 2004

Computerworld reports on the security issue involving Oracle's security holes and it's ongoing effort to depict itself as a vendor of "unbreakable" technology.

David Litchfield, managing director of Next Generation Security Software, Ltd, writes, "They include buffer overflows, SQL injection issues and a whole range of other minor issues," said Litchfield. He said that he reported them to Oracle in January and February following his discovery.

"Some of them can be exploited without a user ID and password, while others require them," Litchfield said. He refused to provide further details of the flaws, citing his concern that doing so before patches are distributed could pose a security risk for users."

Oracle Database expert, Don Burleson comments on this matter is...

"Even so, Oracle's database is by "leaps and bounds" more secure than competing products, said Don Burleson, president of Burleson Consulting in Kittrell, N.C., and author of several books on the security of Oracle products. He said the newly disclosed flaws are unlikely to pose an immediate threat. "Litchfield has made it his life's mission to find flaws in Oracle's technology," Burleson said, adding that most of the flaws are obscure and not easy to find."

http://www.computerworld.com/securitytopics/security/story/0,10801,95106,00.html