U.S. government, companies warn of critical Oracle flaws
611792
US-CERT has issued an alert citing several security flaws in Oracle products that could be used to shut down or take control of vulnerable systems or to corrupt or steal data from Oracle databases.
228223
which has been making headway with companies and governments -- potentially face headaches if the open-source operating system fragments into differing and incompatible versions.
348271
Oracle today announced that it is moving to a quarterly patch release schedule, even as the company faces criticism from analyst firm Gartner Inc. for its handling of a recent critical security fix.
568061
Oracle Corp. urged customers to apply software patches it released in August because of the availability of malicious code that can exploit unpatched vulnerabilities in its software.
719069
(InfoWorld) - The latest version ofÂ Oracle's flagship database offers better security than earlier versions, but development errors have left vulnerabilities that attackers can use to steal data, an expert warned Monday. "Oracle made big progress with 11g, but some of the vulnerabilities I've found so far in 11g are stupid programming errors," said Alexander Kornbrust, managing director of Red Database Security GmbH, during an interview at the Hack In The Box (HITB) Security Conference 2007 in Kuala Lumpur, Malaysia. "Oracle must educate their own development team because they should normally avoid these simple security vulnerabilities," Kornbrust said. Oracle executives were not immediately available for comment. Kornbrust, who helps large companies audit the security of their Oracle databases, examined the software and found SQL injection vulnerabilities, which allow attackers to run malicious code. He also uncovered a way to circumvent the auditing capability in 11g and other versions of the database, which could undermine a company's compliance efforts. While Kornbrust plans to discuss some Oracle vulnerabilities at HITB, he has no plans to detail his method for bypassing the auditing capability until Oracle has fixed the problem. Some of the problems that Kornbrust uncovered reflect architectural problems with Oracle's database. In a talk scheduled for later this week, he plans to demonstrate how architectural problems allow attackers to "bypass and avoid" Oracle's latest security tools, including Oracle Database Vault and Oracle Audit Vault. The cost and time required to fix a vulnerability in Oracle's database can be staggering because of the critical role the software plays in the business of large companies, and the wide range of platforms that Oracle supports, Kornbrust said. Citing the example of one German company that has 8,000 Oracle databases, Kornbrust said rolling out a single patch can require 32,000 hours of labor, or four hours per database. That translates into 60 full-time database administrators and doesn't take into account the time and expense required for testing the patch on each database, he said. Moreover, for each vulnerability that gets patched, Oracle must develop a patch for every version of its database that's supported, with a version of each for every hardware platform and operating system the database runs on. That amounts to around 100 separate patches for every vulnerability, Kornbrust said. HITB runs through Sept. 6.
182123
Oracle (Nasdaq: ORCL) has released a critical patch update -- the first to come out since the company decided to release fixes on a quarterly basis -- that remediates several products across its business line, including databases, application servers, and its e-business software suite.
537932
SEPTEMBER 03, 2004 (IDG NEWS SERVICE) - The US government&#39;s Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.
759978
(InfoWorld) - Oracle went down to the wire in filing its first amended complaint against applications rival SAP Friday in a bitter wrangle over the alleged theft of trade secrets. Under aÂ legal stipulation agreed in mid-May, Oracle had until June 1 to file an amended complaint, while SAP must now respond to Oracle's amended complaint by July 2. Oracle added federal copyright infringement and breach of contract claims on top ofÂ its original charges, which included violations of the Federal Computer Fraud and Abuse Act and of California's Computer Data Access and Fraud Act along with unfair competition and intentional and negligent interference with prospective economic advantage. Oracle filed the original lawsuit on March 22 in the U.S. District Court for the Northern District of California against SAP, its SAP America division, its TomorrowNow subsidiary, and 50 unnamed individuals Oracle claimed were SAP employees. In both the original and the amended complaints, Oracle charged SAP with committing "corporate theft on a grand scale," alleging that one or more staff at TomorrowNow pretended to be Oracle customers andÂ illegally hacked into its secure support Web siteÂ for users of Oracle's PeopleSoft and JD Edwards applications and downloaded a vast amount of material. TomorrowNow provides third-party maintenance and support largely to customers using software Oracle acquired through its purchases of PeopleSoft and Siebel. Oracle further alleged that SAP then copied the content it had accessed from the Oracle site and used it to offer Oracle customers cut-rate support services as the first step in eventually persuading the users to migrate over to SAP's rival applications. In a statement Friday, SAP noted the "repeated delays" in Oracle filing its amended complaint. "Oracle now apparently has registered some copyrights, so it adds a copyright claim," SAP said. "And, it adds a breach of contract claim based on previously stated allegations. SAP plans to respond to the amended complaint by July 2, in accordance with the Court's schedule. At that time, SAP will set the record straight regarding Oracle's allegations. We are eager to vigorously defend this case." Oracle said it had discovered the illegal access to its Customer Connection user support Web site after noting periods of unusually heavy download activity from the site in late November and December 2006. "The downloads spanned every library in the Customer Connection support Web site," the vendor said in the complaint. Using one customer's credentials, those of Honeywell International, SAP allegedly downloaded almost 1,800 items per day for four days straight versus that customer's normal download pattern of 20 items a month. Oracle alleged that it has connected many of those downloads to a specific TomorrowNow employee Wade Walden, who previously worked at PeopleSoft. Each customer searching on the Customer Connection Web site has to click on a button after each search to indicate if the search result helped solve their particular problem. Oracle compiled that data on a regular basis to see how well the system is performing and that's how the vendor noticed sudden spikes in the number of clicks on that button, thousands of clicks per customer and each response occurred in a matter of seconds. "Given the extreme speed at which the activity occurred, these clicks could not reflect real responses from any human customers actually reading the solutions they had accessed," the complaint stated. Instead, Oracle believes an automated process was used to access the materials on the site "with lightning speed." Oracle claims to have found more than 10,000 unauthorized downloads of its software and support materials, which it then traced to an IP address in Bryan, Texas, an SAP America branch office location and the headquarters of TomorrowNow. Oracle adds that the IP address is connected directly to SAP's computer network. "Indeed, Oracle's server logs have recorded access through this same IP address by computers labeled with SAP identifiers using SAP IP addresses," the complaint stated. Oracle listed customers whose identities TomorrowNow had allegedly purloined, including Bear, Stearns & Co., Border Foods, Interbrew UK, Merck, and OCE-Technologies. SAP employees allegedly used bizarre user names including xx, ss, User, and NULL along with fake e-mail addresses, including test@testyomama.com, and fake phone numbers like 123-456-7897, Oracle alleged in the complaint. "All of these customers whose IDs SAP appropriated had one critical fact in common: they were, or were just about to become, new customers of SAP TN [TomorrowNow] -- SAP AG's and SAP America's software support subsidiary whose sole purpose is to compete with Oracle," the complaint stated. Oracle claimed the downloads occurred between September 2006 and January 2007. The complaint added, "Oracle also has concerns that SAP may have enhanced or improved its own software application offerings using information gleaned from Oracle's illegally copied software and support materials." Oracle said in the complaint that it's still unaware of the identities of the unnamed 50 SAP employees charged in the lawsuit. After discovery takes place in the lawsuit, Oracle hopes to unmask them and will amend its complaint accordingly. In the amended complaint, Oracle stated that its software and support materials are registered with the Copyright Office and thus protected under the Federal Copyright Act. The vendor goes on to say that it has now obtained over 40 certificates of registration from the Register of Copyright covering the materials allegedly stolen by SAP. Oracle listed the certificates in the amended complaint; most of the materials were registered on April 26, 2007. Oracle wants the judge in the case to stop SAP's alleged "illegal intrusions and theft," prevent the vendor from using the materials it's alleged to have obtained and to recover damages and attorneys' fees. The case was originally assigned to U.S. District Court Judge Maxine M. Chesney in San Francisco, but she recused herself in early May for reasons that were not disclosed. U.S. District Court Judge Martin J. Jenkins, also in San Francisco, is now presiding over the case. The amended complaint isÂ on Oracle's Web site.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
575251
Oracle has released 26 patches across its product line, nine of which fix vulnerabilities that are remotely exploitable.
77045
SAN FRANCISCO -- Oracle CEO Larry Ellison is convinced that had the intelligence community used a unified database from Oracle, the terrorist attacks on 9/11 would never have happened.
541734
Much has been said about the impact Oracle's (Nasdaq: ORCL) acquisition of PeopleSoft (Nasdaq: PSFT) is likely to have on the enterprise software market. The U.S. Justice Department thought it would have an adverse effect, creating a de facto monopoly. A federal judge thought otherwise, though, as did the European Commission.
545027
The U.S. government has warned banking, stock trading, and other financial Web sites of a potential cyber attack today, but officials and experts alike caution against undue alarm.
448117
U.S. District Court Judge Vaughn Walker said sales documents detailing highly confidential information, such as which companies receive discounts on Oracle products and the size of the discounts, are likely to be made public.
216524
The top US computer security watchdog issues a warning about a flaw in Apple's OS X software.
342998
Security experts are warning of a zero-day vulnerability with Sun Microsystems Inc.'s Solaris 10 and 11 OSes.
411451
Oracle Corp. released several high-risk vulnerabilities reported last month in its database software and other products, and urged customers to download and install them.
735565
(Source: Qualys)  To further enhance its IT system risk management capabilities, Oracle GIT has deployed an on-demand software vulnerability and compliance management solution that allows Oracle GIT to gain significant efficiencies and enhance the company's information security. In addition, Oracle GIT can now more efficiently manage the security of highly-sensitive vulnerability information throughout the deployment of its Security Operation Center.