Oracle Security Vulnerabilities?

Question

Hi all,
We're running many PHP 5.x applications in a distributed environment that use the OCI client to access Oracle 10g databases.
Our server administration group is migrating to a new server and is refusing to install or support the OCI Instant client under Linux saying it's a security problem. Specifically, they say that the OCI Instant Client is exposed to buffer overflows and stack smashing. Their recommendation? Rewrite all our apps to use another database. Yeah, right.
They provided me with two sources to explain the issues:
http://www.dummies.com/WileyCDA/DummiesArticle/id-2900.html
and
Re: Problems with libclntsh.so.10.1 and PHP/Apache HTTPD
Is this really a security problem? If so, what can be done to mitigate the risk?
Thanks,
John

Answer 1

Hi all,
I thought I’d jump in this thread with a few thoughts.
Security flaws unfortunately affect software, both commercial and open source. I believe that what sets Oracle apart from many other vendors is the company’s commitment to security. Oracle Software Security Assurance (http://www.oracle.com/security/software-security-assurance.html) includes the most transparent vulnerability remediation policy in the industry. Furthermore, the Critical Patch Update (CPU) process (http://www.oracle.com/technology/deploy/security/alerts.htm) provides a predictable mechanism for the remediation of security vulnerabilities in Oracle software. By comparison, open source involves unpredictable releases of security fixes.
Now, getting back to the discussion in this thread: as much as we try to prevent vulnerabilities during development, as is the case with all large software products, some make their way into released code. As vulnerabilities are discovered, Oracle fixes them in order of severity and release fixes for them through the Critical Patch Update.
An attacker could attempt to exploit the unpatched vulnerabilities through OCI or other protocols providing access to the database (This is not specific to OCI). Oracle’s recommendation is therefore to remain current on the Critical Patch Update (the last one was issued on July 17, 2007). Keep in mind that the CPU is cumulative for the database, and applying the most recent CPU will bring you at current security patch level, and this will significantly contribute to improving your organization’s security posture.
Do not hesitate to contact me if you have questions at [email protected]
Sincerely
Eric Maurice
Manager – Oracle Software Security Assurance