Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Databases Programming Software Security IT

Security Researcher Says Oracle Slow to Fix Flaw 91

Posted by Zonk from the get-to-work-you-slackers dept.
Billosaur writes "A report by Robert Lemos of SecurityFocus in The Register states that Oracle is being criticized by David Litchfield of Next-Generation Security Software for failing to rapidly patch a known flaw in its database software. Litchfield had made Oracle aware of the flaw last October and is now taking them to task for their slow response to the exploit. Oracle, in turn, has attacked Litchfield: 'We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available... What David Litchfield has done is put our customers at risk.'"
This discussion has been archived. No new comments can be posted.

Security Researcher Says Oracle Slow to Fix Flaw More

Security Researcher Says Oracle Slow to Fix Flaw

Comments Filter:

  • A Cultural Thing? (Score:4, Interesting)

    by ackthpt ( 218170 ) * on Thursday January 26, 2006 @01:32PM (#14569469) Homepage Journal

    [...] Oracle is being criticized by David Litchfield of Next-Generation Security Software for failing to rapidly patch a known flaw in its database software. Litchfield had made Oracle aware of the flaw last October and is now taking them to task for their slow response to the exploit.
    Oracle borrowing from the Microsoft Security-Fixing Playbook?

    "we'll get around to it when we get around to it and not a moment sooner"

    Oracle, in turn, has attacked Litchfield: 'We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available... What David Litchfield has done is put our customers at risk.'"
    Oracle borrowing Microsoft's tactics? What next, alerting Department of Homeland Security?

    Litchfield is al qaeda, you betcha!

    Honestly we can't blame this tactic on Microsoft, though they have been highly visible in this regard, due to their high volume of security flaws. It's almost as bad as a bunch of automaker executives running away from a flaming car and blaming it on Ralph Nader.

    that flaming car, ralph's fault, he's al-qaeda, too.

    Small wonder people have no problem at all in buying imported products and services considering the culture of ass-covering in the United States. Remember when american made goods were the best in the world? Seems a distant memory now.

    prepare a statement to the media which blames others for the problem, distances us from it and doesn't harm our stock value, oh and discontinue our practice of sending out new versions/models for review, tell everyone they just have to trust us that everything is fine and not very many people died horrible flaming death during testing of the software and/or new car model

    • Re:A Cultural Thing? (Score:4, Funny)

      by JordanL ( 886154 ) <jordan.ledouxNO@SPAMgmail.com> on Thursday January 26, 2006 @01:52PM (#14569768) Homepage
      Honestly we can't blame this tactic on Microsoft, though they have been highly visible in this regard, due to their high volume of security flaws. It's almost as bad as a bunch of automaker executives running away from a flaming car and blaming it on Ralph Nader.

      I'm pretty sure that metaphore is bad enough to make baby Jesus cry. I have absolutely no clue how a software company taking longer than 3 months to patch code that could have tens of millions of lines is like automakers blaming a car explosion on ralph nader because he's al queda....

      I understand that you want to try and make everything a political argument about how much America and/or Bush and/or Republicans and/or the intelligence community and/or Congress sucks, but seriously... a software patch?

      • Re:A Cultural Thing? (Score:2, Informative)

        by ackthpt ( 218170 ) *
        I understand that you want to try and make everything a political argument about how much America and/or Bush and/or Republicans and/or the intelligence community and/or Congress sucks, but seriously... a software patch?

        You either misunderstand on purpose or not, but as you've suddenly skewed into the political arena at the 12th word of that sentence, I suggest you re-read the subject line and consider how you're under that blanket, too.

        • You either misunderstand on purpose or not, but as you've suddenly skewed into the political arena at the 12th word of that sentence, I suggest you re-read the subject line and consider how you're under that blanket, too.

          No no no, you don't get to tell me I "misunderstand" because I called you on your veiled political swipes that had NOTHING to do with the discussion.
          • No no no, you don't get to tell me I "misunderstand" because I called you on your veiled political swipes that had NOTHING to do with the discussion.

            "veiled political swipes"???

            One reference to a company running screaming to the government to help it cover it's ass, which has an actual basis in fact (Microsoft willing the government to prevent revelations of Windows security holes on the grounds of National Security) is an attack on Bush and/or Republicans and/or the intelligence community and/or Congres

            • One reference to a company running screaming to the government to help it cover it's ass, which has an actual basis in fact (Microsoft willing the government to prevent revelations of Windows security holes on the grounds of National Security) is an attack on Bush and/or Republicans and/or the intelligence community and/or Congress? You hyper-sensitive twit!

              No, it was two references to trying to hide behind an al queda defense and a "you betcha" reference. You can't seriously think that I was the one ma
              • No, it was two references to trying to hide behind an al queda defense and a "you betcha" reference. You can't seriously think that I was the one making this a political argument.

                Yep, I surely do. You're way off base. You should consider through what colour glasses you are reading and how you arrived at your conclusion. It'll save you a lot of huffing and puffing in the future.

    • "Oracle borrowing from the Microsoft Security-Fixing Playbook?" I'd say they stole it.

      • Re:A Cultural Thing? (Score:2, Informative)

        by ackthpt ( 218170 ) *
        "Oracle borrowing from the Microsoft Security-Fixing Playbook?" I'd say they stole it.

        Again, to be fair to Microsoft, I don't think they wrote it, they've just updated it a bit.

        Back in 1985 I was introduced to the concept of BS'ing on an expensive product from an american company. I truly wasn't expecting a company to utterly flee any responsibility. As it was out of my own time and money the expenses were coming to remedy problems I was acutely in tune with what was transpiring. Why oviously defecti

    • Re:A Cultural Thing? (Score:5, Funny)

      by corbettw ( 214229 ) on Thursday January 26, 2006 @02:11PM (#14570024) Journal
      Remember when american made goods were the best in the world?

      I'm only 34, so, no.

      • Re:A Cultural Thing? (Score:2, Interesting)

        by ackthpt ( 218170 ) *

        Remember when american made goods were the best in the world?

        I'm only 34, so, no.

        Not actually that long ago for many things. I've still got a set of sockets, one of which withstood 175 ft/lbs of torque to remove a stubborn headbolt on an AMC 360 V8 (the engine was wrecked by a dropped valve and shattered piston, but in the sort of grim fascination engineering types hold for such things, we just had to take it apart to see the carnage). Two taiwanese sockets (lifetime guarantee!) split at about 90 ft/l

      • Thats sooo funny at 34 you would not remember. None of my Fathers pre 1960 cars were built that great, just more metal to take a punch.
    • Interestingly enough, I saw Litchfield's post to Bugtraq on this issue. He did not disclose any 'real' information (compared to other posts detailing what problems are and where they are, or even proof of concept exploit code) about the vulnerability that would lead to a compromise, unless you already knew what the compromise was. He did post a workaround, which was an Apache mod_redirect config which catches the attack and rewrites the URI to the denied page.

      But, hey, I'll let you all judge. Here's his
    • I remember, hell I have a whole collection of artifacts from 'the beforetime'. The time when people were willing and able to pay absurd prices for absurdly high quality goods. Then came the age of plastic, and lo, those companies all went out of business. And begat the walmart. DO NOT ANGER THE WALMART!

  • Really a problem? (Score:4, Insightful)

    by PlayCleverFully ( 947815 ) on Thursday January 26, 2006 @01:33PM (#14569494) Homepage
    What if they CANT fix the problem immediately.

    I am a programmer and when I find bugs in my code "pre-release" I find it benefitial. However, some of the bugs I have to spend a substantial amount of time debugging to finally find a fix.

    With the code as large as Oracle's code is.. it could take an extremely long time.

    This is unfortunate.

    • Re:Really a problem? (Score:3, Interesting)

      by Todd Knarr ( 15451 )

      If Oracle can't fix the problem in 3 months, at least they could inform their own customers so they could take protective measures of their own. That Oracle could do inside of 3 months no matter how complex the bug is to finally fix.

      • Re:Really a problem? (Score:2, Informative)

        by Fishstick ( 150821 )
        Especially as there is apparently a workaround

        http://www.securityfocus.com/archive/1/423029 [securityfocus.com]

        The workaround is trivial; using mod_rewrite, which is compiled into
        Oracle's Apache distribution it is possible to stop the attack. The
        workaround checks a user's web request for the presence of a right facing
        bracket, ')'.

        Add the following four lines to your http.conf file then stop and restart
        the web server

        RewriteEngine on
        RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
        RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempte [127.0.0.1]

      • Re:Really a problem? (Score:3, Interesting)

        by hackstraw ( 262471 ) *
        If Oracle can't fix the problem in 3 months, at least they could inform their own customers so they could take protective measures of their own. That Oracle could do inside of 3 months no matter how complex the bug is to finally fix.

        I admin an Oracle database, and I am not a fan (I am also NOT a DBA, its just a small part of my job for bioinformatics research). With the latest worms and whatever security announcements, it seems as a registered and paying metalink member, I should quickly and easily downloa
        • It took 20 minutes of webflailing to find patches on metalink?

          Over what, 1200 baud? Where you trying to whistle into a modem with a microphone?

          I can find "the latest patches" in... lessee.

          Login.
          Click tab at top right called "Patches and Updates" -- deviously named and not at all intuitive.

          On the next page, there's:
          Simple Search
          Advanced Search
          E-business Suite Recommended Patch List
          Quick Links to the Latest Patchsets, Minipacks, and Maintenance Packs
          Your Saved Searches

          Wow... where to go next? If you're cra

    • Re:Really a problem? (Score:5, Interesting)

      by GrenDel Fuego ( 2558 ) on Thursday January 26, 2006 @02:01PM (#14569891)
      What if they CANT fix the problem immediately.

      If they can't fix it immediately, then they should let him know WHEN they're going to fix it. David announced this because he was expecting a fix in the January update, and it was not there.

      On top of this, for the past few months he's been complaining about the fact that some of the vulnerabilities he has told Oracle about have gone unpatched for 2+ years. He has already tried the "responsible disclosure" route with Oracle. They're just not being responsive.

      I think that his announcement and others like it will be the only way to get Oracle to respond. I'm just worried about what this means for the next X months.

      • ...Oracle should contact him immediately, and determine any schedule he may have on revealing further security flaws.

        I assume that Litchfield has additional bombshell revelations in store, and it is obvious that he has run out of patience.

        Oracle should be silent on criticism of Litchfield, and they should quickly triage which problems they intend to solve, and when.

        p.s. Oracle should also stop distributing Apache. Their version has more holes than swiss cheese.

    • >With the code as large as Oracle's code is

      Actually, this doesn't appear to be a problem in the db server software, but with an Apache module they distribute:

      The flaw occurs in the way that a module in Oracle's Apache Web server distribution handles input and could give external attackers the ability to take control of a backend Oracle database through the Web server, said David Litchfield

      If this is the case, it would seem that the amount of code should be significantly smaller than what you might imagin

    • It's not a fundamental bug (Score:2, Insightful)

      by Anonymous Coward
      While the posing doesn't explain the vulnerability in detail, you can see from the fix that it's inadequate input validation, which is easy to add. There's an access control mechanism that's supposed to prevent access to certain features from the web interface, and it's not doing its job.

      While sometimes there are fundamental design problems, this doesn't look like such a case.

      (And in such a case, you should explain to the problem reporter why this is an exceptionally difficult bug and ask for an exceptiona

    • Re:Really a problem? (Score:3, Informative)

      by Shoten ( 260439 )
      With the code as large as Oracle's code is.. it could take an extremely long time.

      Okay, hang on. I know Litchfield, and he's no dummy (and he's a coder as well). First of all, Oracle isn't one guy debugging the code, as you are; it's a whole huge company, with literally thousands of programmers. Their code is in a system like Rational, which helps with modeling as well (thus enabling people to find the sections of code that control various aspects of the software...so you don't have to go looking through
    • What if they CANT fix the problem immediately.

      You make a valid point, as a software developer I too have run into bugs for which the solution was not a simple one. That being said, the users of Oracle are paying outrageous prices for the database and in doing so expect that Oracle will move mountains if needed to find a quick solution to the problem. They could get it done faster if it was a priority for them, and with the cost of Oracle I would expect them to put 500 developers on the problem if that'
      • "...or they will go find an alternative."

        What alternative? Most large organizations that use Oracle have so much invested in that company, there is no alternative! It's too expensive to switch, even if there was one...
      • That being said, the users of Oracle are paying outrageous prices for the database Bingo, with as expensive as Oracle is, something like this is inexcusable. WTF is Oracle doing with all of that money? Oracle AS and DB are probably two of the most expensive pieces of software out there(atleast of stuff that is somewhat common). Each copy of Oracle AS or DB Enterprise could pay for practically someone's yearly salary(even if it was just a 1-CPU license). And I'm assuming(though I do not know) that Oracl

    • Re:Really a problem? (Score:2, Informative)

      by CaptKeen ( 92992 )
      I am a programmer and when I find bugs in my code "pre-release" I find it benefitial. However, some of the bugs I have to spend a substantial amount of time debugging to finally find a fix.

      With the code as large as Oracle's code is.. it could take an extremely long time.

      Yes, but they could have at least published a workaround the problem, even if they don't have the fix in place. There is a 4 line change to the Apache setup which acts as a workaround for the problem; David Litchfield posted it to Bugtraq h

  • Who put their customers at risk!!?! (Score:3, Insightful)

    by SillySlashdotName ( 466702 ) on Thursday January 26, 2006 @01:34PM (#14569510)
    Oracle sold crap software, did not fix it when told about a problem.

    So tell me again, Oracle, WHO put their customers at risk?

    • Heh. I agree but... Have you read the EULA recently? I'm sure Oracle specifically disclaims any responsibility for anything that their software does, doesn't, might, or might not do.

      This is precisely why EULAs were started--to shield commercial businesses from liability for producing (often knowingly) a seriously flawed product. EULAs are the devil.
      • The interesting thing is that you can disclaim responsibility all you want, but that doesn't stop the people who write the checks from remembering you screwed them and going somewhere else next time.

        That's what vendor lock-in and consultants are for.
      • This is precisely why EULAs were started--to shield commercial businesses from liability for producing (often knowingly) a seriously flawed product. EULAs are the devil.

        Yeah, especially the ones with the line "This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." Those things are just plain evil!

      • Comment removed based on user account deletion
    • Oversimplifying the issue does nothing for the discussion. Just because there is a flaw doesn't mean they've shipped "crap software". Bugs happen, end of story.

      Now, that being said, three months without a fix and/or mitigation technique is a problem. That is how the discussion should be framed, or its just going to come across as a bunch of teeth nashing by knee jerk idiots.

  • who is to blame? (Score:2, Insightful)

    by jwegy ( 775655 )
    What David Litchfield has done is put our customers at risk
    Isn't Oracle the one who has put their customers at risk?

  • Who's putting customers at risk? (Score:5, Insightful)

    by Todd Knarr ( 15451 ) on Thursday January 26, 2006 @01:36PM (#14569531) Homepage

    Litchfield is putting Oracle's customers at risk? I don't think so. Oracle put their customers at risk, Litchfield merely told those customers they were at risk and in what way. He gave Oracle 3 months to either fix the problem or inform their customers, Oracle did neither, I'd say the problem's all of Oracle's making. If they'd placed their customer's security over their own PR in a reasonable timeframe, Litchfield wouldn't have had to embarrass them this way.

    Another example of why "reasonable disclosure" doesn't work well.

    • EULA. It's highly likely that they specifically disclaim any responsibility for anything related to the functionality or security of their product. It is the EULA which allows the maker of a flawed product to point the evil eye towards anyone who would have the audacity to point out the flaws.

      EULAs must die.
      • It's also extremely likely that the EULA has absolutely no effect on liability. Just because you sign a document stating that you waive your right to sue, doesn't mean they aren't still liable for negligence. Most waivers aren't worth the paper they're printed on.

  • It's the other way around.. (Score:5, Insightful)

    by deep44 ( 891922 ) on Thursday January 26, 2006 @01:38PM (#14569556)
    We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available...
    We (consumers) are always disappointed when vendors postpone a patch for a critical vulnerability to the point where a researcher must release the details of said vulnerability in order to motivate the vendor.

  • Huh? (Score:2, Insightful)

    by Realistic_Dragon ( 655151 )
    He gave them more than 3 months to fix it. They didnt. He releases the information so that admins can take steps to protect themselves... ...and they call HIM the dick? Right...

  • Researcher point of view (Score:5, Informative)

    by dtfinch ( 661405 ) * on Thursday January 26, 2006 @01:42PM (#14569624) Journal
    We are always disappointed when software companies force us to publish details of vulnerabilities before making a fix available.

    As bad as it is to publish unpatched vulnerabilities, it's worse if a company chooses to ignore security altogether. Ignoring security and suppressing vulnerability reports demands that vulnerabilities be published. People generally won't publish vulnerabilities if they see that the company it taking them seriously.

  • Recall product (Score:1, Insightful)

    by Anonymous Coward
    If a vulnerable product cannot be patched in a reasonable timeframe ..

    RECALL THE PRODUCT!

    That's what car makers do.

    And yes, software is critical.

    • Re:Recall product (Score:1, Informative)

      by Anonymous Coward
      >And yes, software is critical.

      When customers such as government agencies and hospitols rely on your product to store their data, it is pretty damned critical. If you were a patient in a hospitol, the database could be life or death to you.
  • Comment removed based on user account deletion
  • The simplest answer lies where Oracle needs to provide this sort of information to Oracle DBA's and its users on a "need-to-know" basis whereby you log on to their website and become a paying-member for the latest news, security updates, and services (consenting to a non-disclosure agreement). Oracle can easily get away with this as opposed to Microsoft in the OS market because most people who own Oracle are highly trained and need to know this mission critical information.

  • ever heard of regression testing? (Score:4, Interesting)

    by bobalu ( 1921 ) on Thursday January 26, 2006 @02:01PM (#14569894)
    I mean, gee, it's not like they have to test it on a huge number of platforms or anything right? Much better to rapidly fix the bug and then break a bunch of running code, bringing large businesses down to their knees.

    Yes, the bug puts their customers at risk, but detailing the exploit for everyone to see REALLY DOES HELP THE BAD GUYS. Otherwise they have to figure it out for themselves, which is quite a bit harder.
    • Who is to say he's the only person that has figured this problem out?

      He's a smart guy, I'm sure, but there are plenty of smart people and not all of them are on the side of actually helping security. For all we know there could be someone else who figured this out and has been exploiting it perhaps in ways that its even undetectable that there has actually been data theft or changes.

      If administrators know about the problem they are better able to guard against it. Either by reconfiguring permissions on the
      • Replying to myself, I know.

        As a side note I work in the SOA and Web Application Server space as a developer. I know quite well how Oracle's app server works. When it initially came out it was merely a bunch of triggers and stored procedures that spit out HTML over a designated port.

        Customers complained that it was a pain to extend as it did not support any major development platform (Java, .Net, etc). Oracle responded by overlaying an apache app server with a simple Java based framework that for the most pa

    • I mean, gee, it's not like they have to test it on a huge number of platforms or anything right? Much better to rapidly fix the bug and then break a bunch of running code, bringing large businesses down to their knees.

      If you would have read the fine article, you would have known that flaws in this particular piece of code have been discovered over the past few years, with each patch being inadequate in actually fixing it securely. You should think that 4 years would be enough for some regression testing.

    • I didn't see a detail of the exploit, but I did see a detail workaround:

      The workaround is trivial; using mod_rewrite, which is compiled into
      Oracle's Apache distribution it is possible to stop the attack. The
      workaround checks a user's web request for the presence of a right facing
      bracket, ')'.

      Add the following four lines to your http.conf file then stop and restart
      the web server

      RewriteEngine on
      RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
      RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempted-attack [127.0.0.1]
      RewriteRule
  • This example highlights how institutions (gov't corps) long ago superceded the individual in terms of credibility on an unconcious level. Oracle today, Cisco a few months ago. Years ago there was a guy doing research on censorware. I recall that guy maintains he's a "victim" of the DMCA. You need more proof? All the moral outrage about this guy on /. and no action. Nothing.

    Just one lesson to learn here is there needs to be some kind of standard procedure for notifying and working with companies with fl
  • What David Litchfield has done is put our customers at risk.

    It would seem to me that what put Oracle's customers at risk was the security flaw itself, not someone's disclosure of it.

  • As well as the groundswell of anger and resentment building up against Oracle (who were already notorious for charging the earth for crappy products, of which only the flagship database offers anything you can't get elsewhere - and even then, the RDBMS hardkore out there will tell you that very very few places use those features) - it's interesting to note that even Gartner, friend of the PHB everywhere, have turned on their erstwhile prize vendor.

    http://news.com.com/Gartner+Oracle+no+longer+a+ba s tion+o [com.com]

  • Indeed. [oracle.com]
  • Breaking news... pot calls kettle black. Film at 11.
  • What David Litchfield has done is put our customers at risk
    After all, it *is* best practice to kill the messenger.
  • but a hole in OHS (Oracle's distributed Apache server).

    There's a critical flaw in the Oracle PLSQL Gateway, a component of iAS, OAS
    and the Oracle HTTP Server, that allows attackers to bypass the
    PLSQLExclusion list and gain access to "excluded" packages and procedures.
    This can be exploited by an attacker to gain full DBA control of the backend
    database server through the web server.

    This flaw was reported to Oracle on the 26th of October 2005. On November
    the 7th NGS alerted NISCC (http://www.niscc.gov.uk/ [niscc.gov.uk] to t
  • When I was at university, there was a program publishing confidential information to /tmp with read all access. I alerted the system administrators and officials, and they said thanks, they'd fix it.

    A few months later, I noticed the same stuff getting generated, so I complained, and was told that it was fixed.

    So I posted the information in an adminstrators newsgroup.

    Suffices to say, I was BAD for publishing confidential information. I got my privs removed, threatened with expulsion, but hey, the problem w
  • ...the ones that all say the same thing about Oracle putting their customer at risk and people complaining about all of the redundant comments. Jeez!!! What, did the Borg just invade /. or something?!


    --
    I am not an actor but I play one on TV
  • am I putting citizens at risk too?

    According to Oracle's way of thinking I am. So, I should NOT warn those in danger and just secretly call the Fire Department?

    How lame does Oracle think people are... well, just as lame as Microsoft thinks they are. And they must be. Look how many put up with hole after hole after hole, and even defend MS on the blogs for not fixing holes.

    People get EXACTLY what they allow, or worse.
  • Plain any simple, any Database directly accessable to the open world with a nice public IP or no filtering is clearly run by idiots. Agreed a slow response is a slow response, but it's like a local exploit on a low-volume internal machine... the response is 'when you get around to it'.

    -M
  • Ah, right, Oracle. This is how your customers read your spin, though: "We [customers] are always disappointed when [Oracle] feel[s] the need to [place blame] before a fix is available... What [Oracle] has done is [ensure we are not] at risk[ - only if third parties shut up, heed its whining, and play nicely!]" Oracle makes the point itself: its customers are at risk - period. ...too bad Oracle's hot air hasn't lifted a fix off the ground yet!

Slashdot Top Deals

This file will self-destruct in five minutes.

Close