(Linkleri Üyelerimiz Görebilir. UslanmaM Üyeliği İçin Tıklayın) - The latest version of:-)Linkleri Üyelerimiz Görebilir. UslanmaM Üyeliği İçin Tıklayın offers better security than earlier versions but development errors have left vulnerabilities that attackers can use to steal data an expert warned Monday.
"Oracle made big progress with 11g but some of the vulnerabilities I've found so far in 11g are stupid programming errors" said Alexander Kornbrust managing director of Red Database Security GmbH during an interview at the Hack In The Box (HITB) Security Conference 2007 in Kuala Lumpur Malaysia.
"Oracle must educate their own development team because they should normally avoid these simple security vulnerabilities" Kornbrust said.
Oracle executives were not immediately available for comment.
Kornbrust who helps large companies audit the security of their Oracle databases examined the software and found SQL injection vulnerabilities which allow attackers to run malicious code. He also uncovered a way to circumvent the auditing capability in 11g and other versions of the database which could undermine a company's compliance efforts.
While Kornbrust plans to discuss some Oracle vulnerabilities at HITB he has no plans to detail his method for bypassing the auditing capability until Oracle has fixed the problem.
Some of the problems that Kornbrust uncovered reflect architectural problems with Oracle's database. In a talk scheduled for later this week he plans to demonstrate how architectural problems allow attackers to "bypass and avoid" Oracle's latest security tools including Oracle Database Vault and Oracle Audit Vault.
The cost and time required to fix a vulnerability in Oracle's database can be staggering because of the critical role the software plays in the business of large companies and the wide range of platforms that Oracle supports Kornbrust said.
Citing the example of one German company that has 8000 Oracle databases Kornbrust said rolling out a single aaaaa can require 32000 hours of labor or four hours per database. That translates into 60 aaaa-time database administrators and doesn't take into account the time and expense required for testing the aaaaa on each database he said.
Moreover for each vulnerability that gets aaaaaed Oracle must develop a aaaaa for every version of its database that's supported with a version of each for every hardware platform and operating system the database runs on. That amounts to around 100 separate aaaaaes for every vulnerability Kornbrust said.
HITB runs through Sept. 6.


Linkleri Üyelerimiz Görebilir. UslanmaM Üyeliği İçin Tıklayın