http://www.pcworld.com/article/id,136699-c,applicationbugs/article.html 

By Sumner Lemon
IDG News Service
September 03, 2007

The latest version of Oracle Corp.'s flagship database offers better 
security than earlier versions, but development errors have left 
vulnerabilities that attackers can use to steal data, an expert warned 
Monday.

"Oracle made big progress with 11g, but some of the vulnerabilities I've 
found so far in 11g are stupid programming errors," said Alexander 
Kornbrust, managing director of Red Database Security GmbH, during an 
interview at the Hack In The Box (HITB) Security Conference 2007 in 
Kuala Lumpur, Malaysia.

"Oracle must educate their own development team because they should 
normally avoid these simple security vulnerabilities," Kornbrust said.

Oracle executives were not immediately available for comment.

Kornbrust, who helps large companies audit the security of their Oracle 
databases, examined the software and found SQL injection 
vulnerabilities, which allow attackers to run malicious code. He also 
uncovered a way to circumvent the auditing capability in 11g and other 
versions of the database, which could undermine a company's compliance 
efforts.

While Kornbrust plans to discuss some Oracle vulnerabilities at HITB, he 
has no plans to detail his method for bypassing the auditing capability 
until Oracle has fixed the problem.

Some of the problems that Kornbrust uncovered reflect architectural 
problems with Oracle's database. In a talk scheduled for later this 
week, he plans to demonstrate how architectural problems allow attackers 
to "bypass and avoid" Oracle's latest security tools, including Oracle 
Database Vault and Oracle Audit Vault.

The cost and time required to fix a vulnerability in Oracle's database 
can be staggering because of the critical role the software plays in the 
business of large companies, and the wide range of platforms that Oracle 
supports, Kornbrust said.

Citing the example of one German company that has 8,000 Oracle 
databases, Kornbrust said rolling out a single patch can require 32,000 
hours of labor, or four hours per database. That translates into 60 
full-time database administrators and doesn't take into account the time 
and expense required for testing the patch on each database, he said.

Moreover, for each vulnerability that gets patched, Oracle must develop 
a patch for every version of its database that's supported, with a 
version of each for every hardware platform and operating system the 
database runs on. That amounts to around 100 separate patches for every 
vulnerability, Kornbrust said.

HITB runs through Sept. 6, 2007


____________________________________
Attend HITBSecConf2007 - Malaysia 
Taking place September 3-6 2007 featuring seven tracks of technical 
training and a dual-track security conference with keynote speakers 
Lance Spitzner and Mikko Hypponen!  -  Book your seats today! 
http://conference.hitb.org/hitbsecconf2007kl/