Allegations of 42 new un-patched Oracle security exposures
called a "publicity stunt"
June 2, 2005
In this eWeek article by Lisa Vaas, we
see serious allegations made by
Red-Database-Security gmbh about 42 new security exposures within
Oracle.
http://www.eweek.com/article2/0,1759,1821232,00.asp?kc=enews052705dtx1k0000599
Vaas references Alexander Kornbrust's
claims that he used Oracle MOSC keyword searches to uncover serious un-patched
Oracle security exposures:
"Within 42 hours I was able to find 42 bugs with security
potential (e.g., denial of service, SQL Injection, …)," RDS'
Alexander Kornbrust said from Germany via an e-mail
conversation. "I stopped after 42 bugs." He said he then
reported the bugs to Oracle.
These bugs are not addressed by Oracle's latest security patch
set, Kornbrust said.
However, Oracle and top-rated security experts have disagreed with Mr. Kornbrust's allegations:
Oracle could not provide formal feedback to the report by the
time this story was posted, although a spokesperson did point
out some inaccuracies in the report regarding which and how many
Oracle employees have access to search the global repository of
technical knowledge and to query the bug database for known
issues.
However, some security experts say that
there is no reason to panic. Donald K. Burleson, author of the
bestselling book "Oracle
Privacy Security Auditing" notes that these claims are too
outlandish to be credible:
It might be possible to find an
Oracle client who is experiencing a vulnerability by clicking on
the name of the forum poster's e-mail address, and I agree that
it is a good idea to use anonymous or third-party e-mail
addresses with all MOSC accounts, especially when discussing
a security vulnerability.
This reports strikes me of a
publicity stunt. By their own admission,
Red-Database-Security was searching inside the Oracle MOSC
support forums, a place where Oracle employees are very quick to
react to security issues.
Any script kiddie can run searches
on terms like "hacker" and "SQL injection" on MOSC, but to
come to the conclusion that these MOSC forums contain
"sensitive information" is ludicrous.
The most bizarre part of this
allegation is that Kornbrust's is "disturbed" because MOSC
contains a rich repository of bug information!
What makes the vulnerabilities
particularly disturbing, security experts say, is that
Oracle has built up such a rich repository in its MOSC
forum.
It's
also worth noting that Red-Database-Security has published excerpts
from Johnny Long's web site containing a list of Google searches
that might reveal Oracle exposures over the web.
http://www.red-database-security.com/wp/google_oracle_hacking_us.pdf
Regardless of the real threat, it is clear that using search engines
to uncover information has become a very hot topic in the IT
industry.
|
