Expert finds 'stupid' holes in Oracle 11g

Architectural problems, one researcher says, let attackers 'bypass and avoid' Oracle's newest security tools. The latest version of Oracle's flagship database offers better security than earlier versions, but development errors have left vulnerabilities that attackers can use to steal data, an expert warned Monday.

"Oracle made big progress with 11g, but some of the vulnerabilities I've found so far in 11g are stupid programming errors," said Alexander Kornbrust, managing director of Red Database Security GmbH, during an interview at the Hack In The Box (HITB) Security Conference 2007 in Kuala Lumpur, Malaysia.

"Oracle must educate their own development team because they should normally avoid these simple security vulnerabilities," Kornbrust said.

Oracle executives were not immediately available for comment.

Kornbrust, who helps large companies audit the security of their Oracle databases, examined the software and found SQL injection vulnerabilities, which allow attackers to run malicious code. He also uncovered a way to circumvent the auditing capability in 11g and other versions of the database, which could undermine a company's compliance efforts.

While Kornbrust plans to discuss some Oracle vulnerabilities at HITB, he has no plans to detail his method for bypassing the auditing capability until Oracle has fixed the problem.

Some of the problems that Kornbrust uncovered reflect architectural problems with Oracle's database. In a talk scheduled for later this week, he plans to demonstrate how architectural problems allow attackers to "bypass and avoid" Oracle's latest security tools, including Oracle Database Vault and Oracle Audit Vault.

The cost and time required to fix a vulnerability in Oracle's database can be staggering because of the critical role the software plays in the business of large companies, and the wide range of platforms that Oracle supports, Kornbrust said.

Citing the example of one German company that has 8,000 Oracle databases, Kornbrust said rolling out a single patch can require 32,000 hours of labor, or four hours per database. That translates into 60 full-time database administrators and doesn't take into account the time and expense required for testing the patch on each database, he said.

Moreover, for each vulnerability that gets patched, Oracle must develop a patch for every version of its database that's supported, with a version of each for every hardware platform and operating system the database runs on. That amounts to around 100 separate patches for every vulnerability, Kornbrust said.

Author: Sumner Lemon

Read more ...

Oracle Opens Nominations for Oracle Innovation Award

REDWOOD SHORES, Calif., Sept. 6 /PRNewswire-FirstCall/ -- Oracle today announced the call for nominations for the Oracle Innovation Award. Co-sponsored by the Oracle Applications User Group (OAUG) and Quest International Users Group (Quest), the Oracle Innovation Award is designed to recognize organizations that are extending the business value of their Oracle(R) Applications with Oracle Fusion Middleware as a result of Oracle's "Applications Unlimited" program.

Customers throughout the world can submit nominations between now and Oct. 5, 2007, to showcase their innovation with Oracle Fusion Middleware and Oracle Applications including the Oracle E-Business Suite, Oracle's PeopleSoft Enterprise, Oracle's JD Edwards EnterpriseOne and Oracle's Siebel CRM applications. To qualify, organizations must be using at least one component of Oracle Fusion Middleware, at least one Oracle Application and have the solution in production or in active development. 25 winners will receive a conference pass to Oracle OpenWorld(R) San Francisco 2007, with access to the Global Customer Program lounge and a one-on-one conversation with an Oracle executive at an award reception scheduled to take place at the event. In addition to these prizes, the top five winners will also receive one Oracle OpenWorld San Francisco 2007 conference pass with a Club Oracle Gold upgrade; will be featured in a cover story article alongside their systems integrator partner (if applicable) in Oracle's Profit magazine; and will have an exclusive appearance on Oracle's podcast
series, Appcast.(i)

"Oracle Fusion Middleware's hot-pluggable architecture and portfolio of best-in-class middleware components enable customers of any size to increase the value of their applications across user communities, lines of business and organizations," said Amit Zavery, vice president, Oracle Fusion Middleware Product Management, Oracle. "While customers experience substantial benefits from using Oracle Fusion Middleware with Oracle Applications, the Oracle Innovation Award gives us the opportunity to publicly commend and reward organizations for their particularly innovative use of these offerings."

"As a result of our Applications Unlimited program, many of our customers are evolving their existing Oracle Applications to leverage next-generation technology such as Service-Oriented Architectures and Web 2.0 design principles," said Evelyn Neumayr, vice president, Applications
and Industries Marketing. "The Oracle Innovation Award will highlight these customers for their work in this area and will serve as excellent examples for organizations that are currently seeking ways to drive added value from their applications investments."

Selecting the Winners

The Award Selection Committee, consisting of individuals from Oracle, OAUG and Quest, will select the winners based on factors including the level of impact relative to the size of the organization, complexity of the implementation and future plans. Winners will be notified of their
successful submission by Monday, Oct. 15, 2007, and will be publicly announced at Oracle OpenWorld San Francisco the week of Nov. 12, 2007. For additional information regarding this award please visit: http://www.oracle.com/applications/oracle-innovations-award.html.

Source: PRNewswire

Read more ...

Oracle-SAP court faceoff postponed

FRANKFURT, Germany - SAP AG's first court meeting with rival Oracle Corp. over an industrial espionage lawsuit has been rescheduled for Sept. 11, the German company said Wednesday.

The two companies were set to meet in a San Francisco federal court this week but the judge fell ill.

The Sept. 11 date is tentative, pending final approval from the court, SAP told Dow Jones Newswires.

Redwood Shores, Calif.-based Oracle sued SAP on March 22, accusing the Walldorf-based company of "corporate theft on a grand scale" and claiming that SAP obtained secret product information to gain new customers.

SAP has acknowledged "some inappropriate downloads of fixes and support documents occurred at TomorrowNow" - a Texas-based customer support unit authorized to download materials from Oracle's Web site. But it said the data remained within that unit's system and SAP did not have access to Oracle's intellectual property.

SAP and TomorrowNow have been asked by the U.S. Justice Department to provide documents related to Oracle's lawsuit, the company said.

SAP bought TomorrowNow in early 2005, around the same time Oracle completed its $11.1 billion PeopleSoft acquisition. TomorrowNow, which operates as SAP TN, was formed by several former PeopleSoft engineers promising to provide less expensive software support.

SAP said TomorrowNow was authorized to download materials from Oracle's Web site on behalf of TomorrowNow customers.

In its lawsuit, Oracle claimed that TomorrowNow infiltrated Oracle's systems by using the log-in information of defecting customers and then tried to conceal its actions by using phony phone numbers and fake e-mail addresses, the lawsuit alleged.

Oracle and SAP have long engaged in public exchanges of one-upmanship as they fight for new customers and try to pull service contracts from their each other's existing customer base.

Source: www.mercurynews.com

Read more ...