US government, companies warn of critical Oracle flaws
17527
The US government&#39;s Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.
449710
A security expert has found programming errors in Oracle 11g that left security vulnerabilities.
420747
VMware has patched critical flaws in its virtualization products.
624148
Patching is the top concern of security managers in federal government, who feel that commercial software makers aren&#39;t putting out a good enough product, according to a survey published Monday.
679082
Experts are concerned that data may not being properly protected by the IRS and that a massive data loss by the agency, similar to the one last month by the U.K.'s Revenue and Customs office, could disrupt the nation's banking system.
21824
Software giant hopes to convince governments that its products are secure.
80723
Software maker says it's seeing "unacceptable number of repairs;" investigation finds several factors could lead to hardware failures.
96763
Lousy code, PHP and shell script attacks and search engine hacking tools lead to vulnerabilities, study says.
18264
British officials say they warned the US government last month that problems at a drug manufacturing plant could disrupt influenza vaccines to the United States.
622890
The US government is ill-prepared to address allegations of voting fraud should they arise during next month's presidential and legislative elections, a congressional report concluded.
740862
TechWeb - A project sponsored by the Department of Homeland Security spotlights defects in popular applications such as Linux and Apache. But there's also good news.
446418
(InfoWorld) - Oracle Corp. has always made bold claims about the security of its database and applications. Now the company has said it will make security a priority as it begins rolling out its next-generation software products for building service-oriented architectures (SOAs), Oracle Fusion, in the next several years. Speaking at an event in New York on Wednesday, Oracle President Charles Phillips outlined three areas of security that will be important to Oracle going forward -- access control, data privacy and compliance. Acquisitions and internal product development over the last 18 months have given Oracle a comprehensive portfolio in this area, allowing the company to think of security "holistically" across its product line, he said. "We take it pretty seriously," Phillips said. "We [are putting] security where it belongs, which is consistent across the architecture." Oracle has had its ups and downs when it comes to security. The company is infamous for a 2002 marketing campaign in which it called its database "unbreakable," a notion that was proven wrong by security researchers. While Oracle's database has not been the target of a widespread attack, security experts point out that it is also in a less vulnerable position than many commonly targeted programs. Oracle databases are embedded so deeply in a network's infrastructure that attacks aimed for it are thwarted by technologies closer to the surface, such as firewalls. The true test of Oracle's security will come when it begins opening up its products to allow for SOAs, which enable applications to communicate via Web services standards across disparate systems. "Adding Web services to an architecture makes everything often more insecure because you add an additional way into the database," said Alexander Kornbrust, chief executive officer of security consulting firm Red Database Security GmbH. "Web services should be designed and developed very carefully." Beginning in March 2005, Oracle began a string of purchases to bolster its security portfolio. In March the company purchased Oblix, which has access-management software. Then last November, Oracle acquired Thor Technologies for identity provisioning and compliance software and Octet String for identity virtualization software. The company is combining these acquired technologies with new software it developed internally: Database Vault, which prevents the database administrator from accessing sensitive information stored in an Oracle database, and Audit Vault, a data warehousing product to keep track of data stored in various places. The former is available now, while Audit Vault will be available in the next few months, said Thomas Kurian, senior vice president of server technology for Oracle. Together with existing products such as Oracle Identity Federation, the products help shore up a strong portfolio for protecting data across multiple applications and systems in the network, he said. Oracle has these products now, but they will become increasingly important as SOAs become more prevalent and Oracle rolls out its Fusion architecture over the next couple of years, Kurian said. "We'll be making sure at each level of the application, you have common policies that are enforced," he said. "No matter where you come in [on a network], you can still access security." Charles Kolodgy, an IDC security analyst, called Oracle's presentation on Wednesday "a little underwhelming," but said the message the company was trying to send is important. "Many of their customers are not aware that Oracle has security offerings to help customers manage identity, data protection and compliance," Kolodgy said. "They have been know for building security into their products, but not for building security products." However, despite the rosy picture Oracle paints about its past and future security strategy, it's something customers have traditionally been less than happy with, Kornbrust said. New products like Data Vault and Oracle Transparent Data Encryption -- which encrypts database data and stores the encryption keys in another location -- show the company is taking security more seriously, he said. But Oracle has a long way to go before it gets it right. "They are not doing enough helping customers to make their database secure," Kornbrust said. "The patches are still ugly ... Selling new -- and expensive -- high-end features is good but doesn't raise the bar for the normal Oracle security. Most databases I see are vulnerable in most cases." Still, said Kornbrust -- whose firm handles Oracle security exclusively -- those responsible for securing Oracle infrastructure "appreciate the direction Oracle is taking in the last month." However, it will take at least two to four years for most database administrators and developers to see results of the changes taking place now, he said.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
212311
A US security company is warning that it has found ten &#39;serious&#39; vulnerabilities in Windows XP systems with SP2 installed.
751192
Oracle Corp. sales documents detailing highly confidential information, such as which companies receive discounts on Oracle's business software products and the size of the discounts, are likely to be made public, a federal judge said on Friday.
499750
(InfoWorld) - Oracle will release 46 patches on Tuesday for products including its Oracle Database 10g, Application Server, and E-Business Suite. Oracle Database will get 20 fixes, two of which patch vulnerabilities that could allow remote execution of code on the network without authentication. The most serious of the database vulnerabilities is ranked "medium" in severity, according to the Common Vulnerability Scoring System, used to rank the severity of security flaws. The E-Business Suite will get 14 patches, also for vulnerabilities that could be exploited over a network without a username and password. Three of the four patches for Oracle's Application Server fix problems that could also be exploited remotely. The remaining patches are for Oracle's Collaboration Suite, PeopleSoft Enterprise PeopleTools, PeopleSoft Enterprise Customer Relationship Management and PeopleSoft Enterprise Human Capital Management. The fixes, along with the product versions affected, are listed in an Oracle advisory. OracleÂ released 37 patchesÂ in April, its previous round of software fixes. Â
596489
Symantec says U.S. agencies need to better protect their cyber assets, echoing concerns raised last year by U.S. Government Accountability Office.
486380
InfoWorld - Oracle plans to fix dozens of flaws in its software products next Tuesday, including critical bugs in the company's database, e-business suite, and application server.