Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Researcher Says Oracle Slow to Fix Flaw

Posted by Zonk on from the get-to-work-you-slackers dept.

Billosaur writes "A report by Robert Lemos of SecurityFocus in The Register states that Oracle is being criticized by David Litchfield of Next-Generation Security Software for failing to rapidly patch a known flaw in its database software. Litchfield had made Oracle aware of the flaw last October and is now taking them to task for their slow response to the exploit. Oracle, in turn, has attacked Litchfield: 'We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available... What David Litchfield has done is put our customers at risk.'"

91 comments

  1. A Cultural Thing? by ackthpt · · Score: 4, Interesting

    [...] Oracle is being criticized by David Litchfield of Next-Generation Security Software for failing to rapidly patch a known flaw in its database software. Litchfield had made Oracle aware of the flaw last October and is now taking them to task for their slow response to the exploit.
    Oracle borrowing from the Microsoft Security-Fixing Playbook?

    "we'll get around to it when we get around to it and not a moment sooner"

    Oracle, in turn, has attacked Litchfield: 'We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available... What David Litchfield has done is put our customers at risk.'"
    Oracle borrowing Microsoft's tactics? What next, alerting Department of Homeland Security?

    Litchfield is al qaeda, you betcha!

    Honestly we can't blame this tactic on Microsoft, though they have been highly visible in this regard, due to their high volume of security flaws. It's almost as bad as a bunch of automaker executives running away from a flaming car and blaming it on Ralph Nader.

    that flaming car, ralph's fault, he's al-qaeda, too.

    Small wonder people have no problem at all in buying imported products and services considering the culture of ass-covering in the United States. Remember when american made goods were the best in the world? Seems a distant memory now.

    prepare a statement to the media which blames others for the problem, distances us from it and doesn't harm our stock value, oh and discontinue our practice of sending out new versions/models for review, tell everyone they just have to trust us that everything is fine and not very many people died horrible flaming death during testing of the software and/or new car model

    --

    A feeling of having made the same mistake before: Deja Foobar
    1. Re:A Cultural Thing? by JordanL · · Score: 3, Funny

      Honestly we can't blame this tactic on Microsoft, though they have been highly visible in this regard, due to their high volume of security flaws. It's almost as bad as a bunch of automaker executives running away from a flaming car and blaming it on Ralph Nader.

      I'm pretty sure that metaphore is bad enough to make baby Jesus cry. I have absolutely no clue how a software company taking longer than 3 months to patch code that could have tens of millions of lines is like automakers blaming a car explosion on ralph nader because he's al queda....

      I understand that you want to try and make everything a political argument about how much America and/or Bush and/or Republicans and/or the intelligence community and/or Congress sucks, but seriously... a software patch?

      --
      FanFictionRecs.net
    2. Re:A Cultural Thing? by PacketScan · · Score: 2, Funny

      "Oracle borrowing from the Microsoft Security-Fixing Playbook?" I'd say they stole it.

    3. Re:A Cultural Thing? by ackthpt · · Score: 2, Informative
      I understand that you want to try and make everything a political argument about how much America and/or Bush and/or Republicans and/or the intelligence community and/or Congress sucks, but seriously... a software patch?

      You either misunderstand on purpose or not, but as you've suddenly skewed into the political arena at the 12th word of that sentence, I suggest you re-read the subject line and consider how you're under that blanket, too.

      --

      A feeling of having made the same mistake before: Deja Foobar
    4. Re:A Cultural Thing? by ackthpt · · Score: 2, Informative
      "Oracle borrowing from the Microsoft Security-Fixing Playbook?" I'd say they stole it.

      Again, to be fair to Microsoft, I don't think they wrote it, they've just updated it a bit.

      Back in 1985 I was introduced to the concept of BS'ing on an expensive product from an american company. I truly wasn't expecting a company to utterly flee any responsibility. As it was out of my own time and money the expenses were coming to remedy problems I was acutely in tune with what was transpiring. Why oviously defective parts would be used, then not updated/replaced ASAP. At the same time I was a programmer on a DEC system and DEC took very, very good care of us (which probably has something to do with why they're out of business now, cared about customers and product rather than maximising profit.)

      --

      A feeling of having made the same mistake before: Deja Foobar
    5. Re:A Cultural Thing? by corbettw · · Score: 4, Funny

      Remember when american made goods were the best in the world?

      I'm only 34, so, no.

      --
      God invented whiskey so the Irish would not rule the world.
    6. Re:A Cultural Thing? by JordanL · · Score: 0, Redundant

      You either misunderstand on purpose or not, but as you've suddenly skewed into the political arena at the 12th word of that sentence, I suggest you re-read the subject line and consider how you're under that blanket, too.

      No no no, you don't get to tell me I "misunderstand" because I called you on your veiled political swipes that had NOTHING to do with the discussion.

      --
      FanFictionRecs.net
    7. Re:A Cultural Thing? by ackthpt · · Score: 1
      No no no, you don't get to tell me I "misunderstand" because I called you on your veiled political swipes that had NOTHING to do with the discussion.

      "veiled political swipes"???

      One reference to a company running screaming to the government to help it cover it's ass, which has an actual basis in fact (Microsoft willing the government to prevent revelations of Windows security holes on the grounds of National Security) is an attack on Bush and/or Republicans and/or the intelligence community and/or Congress? You hyper-sensitive twit!

      --

      A feeling of having made the same mistake before: Deja Foobar
    8. Re:A Cultural Thing? by ackthpt · · Score: 2, Interesting
      Remember when american made goods were the best in the world?
      I'm only 34, so, no.

      Not actually that long ago for many things. I've still got a set of sockets, one of which withstood 175 ft/lbs of torque to remove a stubborn headbolt on an AMC 360 V8 (the engine was wrecked by a dropped valve and shattered piston, but in the sort of grim fascination engineering types hold for such things, we just had to take it apart to see the carnage). Two taiwanese sockets (lifetime guarantee!) split at about 90 ft/lbs.

      Friends returning from being stationed in Korea were fascinated by the locals affinity for american made toasters, pans, etc, which servicemen and their families had taken with them but chose not to haul back home. Seems the koreans prefered these goods as they were far more durable than anything they could find in their markets. Ok, that was probably 10 years ago or so, but you weren't living under a mushroom at that time, were you?

      --

      A feeling of having made the same mistake before: Deja Foobar
    9. Re:A Cultural Thing? by JordanL · · Score: 1

      One reference to a company running screaming to the government to help it cover it's ass, which has an actual basis in fact (Microsoft willing the government to prevent revelations of Windows security holes on the grounds of National Security) is an attack on Bush and/or Republicans and/or the intelligence community and/or Congress? You hyper-sensitive twit!

      No, it was two references to trying to hide behind an al queda defense and a "you betcha" reference. You can't seriously think that I was the one making this a political argument.

      --
      FanFictionRecs.net
    10. Re:A Cultural Thing? by ackthpt · · Score: 1
      No, it was two references to trying to hide behind an al queda defense and a "you betcha" reference. You can't seriously think that I was the one making this a political argument.

      Yep, I surely do. You're way off base. You should consider through what colour glasses you are reading and how you arrived at your conclusion. It'll save you a lot of huffing and puffing in the future.

      --

      A feeling of having made the same mistake before: Deja Foobar
    11. Re:A Cultural Thing? by Saboteur1 · · Score: 1

      Thats sooo funny at 34 you would not remember. None of my Fathers pre 1960 cars were built that great, just more metal to take a punch.

    12. Re:A Cultural Thing? by Anonymous Coward · · Score: 0

      Mentioning Al Qaeda and saying "you betcha" is a swipe at the Republicans and/or Bush?

      Do you also jump when you see your own shadow?

    13. Re:A Cultural Thing? by triffid_98 · · Score: 1

      I remember, hell I have a whole collection of artifacts from 'the beforetime'. The time when people were willing and able to pay absurd prices for absurdly high quality goods. Then came the age of plastic, and lo, those companies all went out of business. And begat the walmart. DO NOT ANGER THE WALMART!

  2. Really a problem? by PlayCleverFully · · Score: 4, Insightful

    What if they CANT fix the problem immediately.

    I am a programmer and when I find bugs in my code "pre-release" I find it benefitial. However, some of the bugs I have to spend a substantial amount of time debugging to finally find a fix.

    With the code as large as Oracle's code is.. it could take an extremely long time.

    This is unfortunate.

    --
    Windows? I haven't used that since 1999. Fix the Slashdot Problems
    1. Re:Really a problem? by Todd+Knarr · · Score: 2, Interesting

      If Oracle can't fix the problem in 3 months, at least they could inform their own customers so they could take protective measures of their own. That Oracle could do inside of 3 months no matter how complex the bug is to finally fix.

    2. Re:Really a problem? by GrenDel+Fuego · · Score: 4, Interesting

      What if they CANT fix the problem immediately.

      If they can't fix it immediately, then they should let him know WHEN they're going to fix it. David announced this because he was expecting a fix in the January update, and it was not there.

      On top of this, for the past few months he's been complaining about the fact that some of the vulnerabilities he has told Oracle about have gone unpatched for 2+ years. He has already tried the "responsible disclosure" route with Oracle. They're just not being responsive.

      I think that his announcement and others like it will be the only way to get Oracle to respond. I'm just worried about what this means for the next X months.

    3. Re:Really a problem? by Fishstick · · Score: 1

      >With the code as large as Oracle's code is

      Actually, this doesn't appear to be a problem in the db server software, but with an Apache module they distribute:

      The flaw occurs in the way that a module in Oracle's Apache Web server distribution handles input and could give external attackers the ability to take control of a backend Oracle database through the Web server, said David Litchfield

      If this is the case, it would seem that the amount of code should be significantly smaller than what you might imagine to be at stake if this were a problem in the db server itself?

      --

      There is much cruelty in the universe, John.
      Yeah, we seem to have the tour map.

    4. Re:Really a problem? by Fishstick · · Score: 2, Informative
      Especially as there is apparently a workaround

      http://www.securityfocus.com/archive/1/423029


      The workaround is trivial; using mod_rewrite, which is compiled into
      Oracle's Apache distribution it is possible to stop the attack. The
      workaround checks a user's web request for the presence of a right facing
      bracket, ')'.

      Add the following four lines to your http.conf file then stop and restart
      the web server

      RewriteEngine on
      RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
      RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempted-attack
      RewriteRule ^.*\).*|.*%29.*$ http://127.0.0.1/denied.htm?attempted-attack
      --

      There is much cruelty in the universe, John.
      Yeah, we seem to have the tour map.

    5. Re:Really a problem? by hackstraw · · Score: 2, Interesting

      If Oracle can't fix the problem in 3 months, at least they could inform their own customers so they could take protective measures of their own. That Oracle could do inside of 3 months no matter how complex the bug is to finally fix.

      I admin an Oracle database, and I am not a fan (I am also NOT a DBA, its just a small part of my job for bioinformatics research). With the latest worms and whatever security announcements, it seems as a registered and paying metalink member, I should quickly and easily download the latest patches off of their site.

      Well, last Friday, I gave up on finding the patches after 20 minutes of searching for them. I sent a problem report asking them what year their calendar said, because mine says 2006. That is ridiculous.

      I've always been under the assumption that all databases are insecure, and should be firewalled off and remotely accessed from a trusted machine over a private network. That seems to be the best thing to do.

    6. Re:Really a problem? by Shoten · · Score: 2, Informative

      With the code as large as Oracle's code is.. it could take an extremely long time.

      Okay, hang on. I know Litchfield, and he's no dummy (and he's a coder as well). First of all, Oracle isn't one guy debugging the code, as you are; it's a whole huge company, with literally thousands of programmers. Their code is in a system like Rational, which helps with modeling as well (thus enabling people to find the sections of code that control various aspects of the software...so you don't have to go looking through ALL of it just to find, say, the section that checks the listener password). And Litchfield told Oracle precisely what the flaw was, the conditions that expose it, etc. So there's no way it should take them 3 months just to find the damned thing. This isn't some guy writing software on his own who hears about a bug in his code; this is an army of developers with some extremely powerful tools for code management, looking for a very well-defined and documented bug, as described to them by someone who is arguably the world's foremost expert on database security.

      But let's say they did need this long just to find it? The standard rules of engagement (I'm referencing RFPolicy in particular here, as it's what I rely on, but the one developed by l0pht works too) for vulnerability disclosure make plenty of room for such an event...PROVIDED the vendor keeps in touch with the researcher who found the bug. If you just ignore him, this is what you get. David's a reasonable and generous man (he must be; he wrote the foreword to my book...that statement also serves as the disclaimer), and I'm sure he'd be willing to help in any way he can.

      --

      For your security, this post has been encrypted with ROT-13, twice.
    7. Re:Really a problem? by XMilkProject · · Score: 1

      What if they CANT fix the problem immediately.

      You make a valid point, as a software developer I too have run into bugs for which the solution was not a simple one. That being said, the users of Oracle are paying outrageous prices for the database and in doing so expect that Oracle will move mountains if needed to find a quick solution to the problem. They could get it done faster if it was a priority for them, and with the cost of Oracle I would expect them to put 500 developers on the problem if that's what it took.

      In other words, your right that sometimes there is alot of work required to fix a problem, but when you charge as much as they do, and pride yourselves in security as they do, then your customers rightfully expect a swift solution, or they will go find an alternative.

      --
      Big ones, small ones, some as big as yer 'ead!
      Give 'em a twist, a flick o' the wrist...
    8. Re:Really a problem? by CaptKeen · · Score: 2, Informative
      I am a programmer and when I find bugs in my code "pre-release" I find it benefitial. However, some of the bugs I have to spend a substantial amount of time debugging to finally find a fix.

      With the code as large as Oracle's code is.. it could take an extremely long time.

      Yes, but they could have at least published a workaround the problem, even if they don't have the fix in place. There is a 4 line change to the Apache setup which acts as a workaround for the problem; David Litchfield posted it to Bugtraq himself in the move that got Oracle so upset with him. Here it is:

      Add the following four lines to your http.conf file then stop and restart the web server

      RewriteEngine on
      RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
      RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempted-attack
      RewriteRule ^.*\).*|.*%29.*$ http://127.0.0.1/denied.htm?attempted-attack
      --
      --
    9. Re:Really a problem? by rahrens · · Score: 1

      "...or they will go find an alternative."

      What alternative? Most large organizations that use Oracle have so much invested in that company, there is no alternative! It's too expensive to switch, even if there was one...

      --
      "Money is truthful. If a man speaks of his honor, make him pay cash." Notebooks of Lazarus Long, Robert A. Heinlein
    10. Re:Really a problem? by imemyself · · Score: 1

      That being said, the users of Oracle are paying outrageous prices for the database Bingo, with as expensive as Oracle is, something like this is inexcusable. WTF is Oracle doing with all of that money? Oracle AS and DB are probably two of the most expensive pieces of software out there(atleast of stuff that is somewhat common). Each copy of Oracle AS or DB Enterprise could pay for practically someone's yearly salary(even if it was just a 1-CPU license). And I'm assuming(though I do not know) that Oracle's support prices are atronomical as well.

      This brings up an important advantage of OSS as well. With proprietary software like Oracle, you don't really have any way to remedy a situation like this: a reasonably fine piece of software isn't fixed or secured because the company is lazy or just doesn't care. With OSS, if you could secure it yourself(or pay someone to do so). And in most cases, you wouldn't even have to do that - if the original maintainer of the OSS software slacked off or stopped maintaining it, then someone else could take over and make the improvements. Which accomplishes what capitalism and big businesses should be focused on: creating a better product to gain customers or users. Not making more money by screwing customers/other business over and not abusing the justice/legal system.

      --
      Every time you post an article on Slashdot, I kill a server. Think of the servers!
    11. Re:Really a problem? by ahmusch · · Score: 1

      It took 20 minutes of webflailing to find patches on metalink?

      Over what, 1200 baud? Where you trying to whistle into a modem with a microphone?

      I can find "the latest patches" in... lessee.

      Login.
      Click tab at top right called "Patches and Updates" -- deviously named and not at all intuitive.

      On the next page, there's:
      Simple Search
      Advanced Search
      E-business Suite Recommended Patch List
      Quick Links to the Latest Patchsets, Minipacks, and Maintenance Packs
      Your Saved Searches

      Wow... where to go next? If you're crazy enough to pick the quick links, you get...

      A list of Oracle products. I assume by your posting you were looking for patches for Oracle Database.... and there it is the third product listed at the top, with that nefarious alphabetical ordering.

      Now it gets tricky... it uses mouseover to have you drag to the specific hardware and OS you need a patch for, then you drag to the particular patch. If you don't know the hardware and OS, you shouldn't be getting patches anyway.

      It took me... 3 whole clicks to find the latest patchset for Oracle 9i for Solaris on the SPARC platform, once I logged in.

      If finding Oracle patches is beyond your skills and deductive abilities, I fear the results of your bioinformatic research.

  3. Who put their customers at risk!!?! by SillySlashdotName · · Score: 2, Insightful

    Oracle sold crap software, did not fix it when told about a problem.

    So tell me again, Oracle, WHO put their customers at risk?

    --
    Acts of massive stupidity are almost never covered by warranty. --me.
    1. Re:Who put their customers at risk!!?! by SilverspurG · · Score: 1

      Heh. I agree but... Have you read the EULA recently? I'm sure Oracle specifically disclaims any responsibility for anything that their software does, doesn't, might, or might not do.

      This is precisely why EULAs were started--to shield commercial businesses from liability for producing (often knowingly) a seriously flawed product. EULAs are the devil.

      --
      fast as fast can be. you'll never catch me.
    2. Re:Who put their customers at risk!!?! by dekemoose · · Score: 1

      Oversimplifying the issue does nothing for the discussion. Just because there is a flaw doesn't mean they've shipped "crap software". Bugs happen, end of story.

      Now, that being said, three months without a fix and/or mitigation technique is a problem. That is how the discussion should be framed, or its just going to come across as a bunch of teeth nashing by knee jerk idiots.

    3. Re:Who put their customers at risk!!?! by lewp · · Score: 1

      The interesting thing is that you can disclaim responsibility all you want, but that doesn't stop the people who write the checks from remembering you screwed them and going somewhere else next time.

      That's what vendor lock-in and consultants are for.

      --
      Game... blouses.
    4. Re:Who put their customers at risk!!?! by corbettw · · Score: 1

      This is precisely why EULAs were started--to shield commercial businesses from liability for producing (often knowingly) a seriously flawed product. EULAs are the devil.

      Yeah, especially the ones with the line "This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." Those things are just plain evil!

      --
      God invented whiskey so the Irish would not rule the world.
    5. Re:Who put their customers at risk!!?! by toadlife · · Score: 1

      All major software packages come with these types of EULAs. It's not limited to the proprietary/commercial software arena.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
  4. who is to blame? by jwegy · · Score: 2, Insightful

    What David Litchfield has done is put our customers at risk
    Isn't Oracle the one who has put their customers at risk?

  5. maybe we should cut them some slack by Anonymous Coward · · Score: 0

    I'm sure if Oracle was a simple company with a simple app, then it would be a piece of cake to patch any issues... but sometimes it takes a while to debug and release a fix

  6. Who's putting customers at risk? by Todd+Knarr · · Score: 4, Insightful

    Litchfield is putting Oracle's customers at risk? I don't think so. Oracle put their customers at risk, Litchfield merely told those customers they were at risk and in what way. He gave Oracle 3 months to either fix the problem or inform their customers, Oracle did neither, I'd say the problem's all of Oracle's making. If they'd placed their customer's security over their own PR in a reasonable timeframe, Litchfield wouldn't have had to embarrass them this way.

    Another example of why "reasonable disclosure" doesn't work well.

    1. Re:Who's putting customers at risk? by Anonymous Coward · · Score: 0

      If it doesn't work, then stop doing it.

    2. Re:Who's putting customers at risk? by Todd+Knarr · · Score: 1

      Many are stopping, hence the screeches from companies. :)

      My person rule about security-related bugs is that I'll give a company 1 month (30 days) from being notified to either a) release a fix, b) disclose the problem and any existing workarounds to the public, or c) get back to me with a really good reason why it's not possible to do either A or B (and "It'll embarrass us." is not

    3. Re:Who's putting customers at risk? by Todd+Knarr · · Score: 1

      Many are stopping, hence the screeches from companies. :)

      My person rule about security-related bugs is that I'll give a company 1 month (30 days) from being notified to either a) release a fix, b) disclose the problem and any existing workarounds to the public, or c) get back to me with a really good reason why it's not possible to do either A or B (and "It'll embarrass us." is not a good reason). If there's evidence the problem's already being exploited (real exploits affecting computers at large, not proof-of-concept stuff) then disclosure will happen immediately to within a few days depending on whether there's a functional work-around and how willing the company seems to be to work on a rapid disclosure (theory here being that if the black hats are already using the vulnerability disclosure won't make the situation worse).

  7. It's the other way around.. by deep44 · · Score: 5, Insightful
    We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available...
    We (consumers) are always disappointed when vendors postpone a patch for a critical vulnerability to the point where a researcher must release the details of said vulnerability in order to motivate the vendor.
    1. Re:It's the other way around.. by spongman · · Score: 1

      can someone explain to me the benifit of releasing the details of the vulnerability?

  8. No, No, No! by Anonymous Coward · · Score: 0

    No, what Oracle did is endanger their customers! What he did was try to help them save their ass.

  9. Huh? by Realistic_Dragon · · Score: 2, Insightful

    He gave them more than 3 months to fix it. They didnt. He releases the information so that admins can take steps to protect themselves... ...and they call HIM the dick? Right...

    --
    Beep beep.
  10. Researcher point of view by dtfinch · · Score: 4, Informative

    We are always disappointed when software companies force us to publish details of vulnerabilities before making a fix available.

    As bad as it is to publish unpatched vulnerabilities, it's worse if a company chooses to ignore security altogether. Ignoring security and suppressing vulnerability reports demands that vulnerabilities be published. People generally won't publish vulnerabilities if they see that the company it taking them seriously.

  11. Oracle's trump card by SilverspurG · · Score: 1

    EULA. It's highly likely that they specifically disclaim any responsibility for anything related to the functionality or security of their product. It is the EULA which allows the maker of a flawed product to point the evil eye towards anyone who would have the audacity to point out the flaws.

    EULAs must die.

    --
    fast as fast can be. you'll never catch me.
    1. Re:Oracle's trump card by Bob+MacSlack · · Score: 1

      It's also extremely likely that the EULA has absolutely no effect on liability. Just because you sign a document stating that you waive your right to sue, doesn't mean they aren't still liable for negligence. Most waivers aren't worth the paper they're printed on.

  12. Blame it on the messenger, again by digitaldc · · Score: 0, Flamebait

    Duncan Harris, senior director of security assurance for Oracle, said in an interview with SecurityFocus.
    "What David Litchfield has done is put our customers at risk."

    This is the same argument that the Bush Administration used when the NYTimes published their story about how Bush & Co. are conducting domestic spying operations in the US.
    Bush & Co. said this story should not have been published because it makes us less safe.

    So instead of acknowledging your shortcomings or wrongdoing, you blame the messenger. This is not very fair in my opinion.
    Why doesn't Oracle just acknowledge the problem and then fix it?

    --
    He who knows best knows how little he knows. - Thomas Jefferson
    1. Re:Blame it on the messenger, again by dmeranda · · Score: 2, Insightful

      What a lame analogy. Trying to compare those two is practially meaningless, unless of course you have a particular extremist political agenda and are looking for any reason at all to try to convince yourself that you must be right.

      Since you brought it up though, lets analyze the analogy. And only in terms of "security", which is what this /. thread is all about.

      Intercepting communications from foreign people believed to be terrorists or connected to them:

        * This activity's purpose is to prevent future "security breaches" (e.g., learning of a terrorist plot).
        * Without this activity, citizens are certainly less safe (meaning this activity has a positive security benifit)
        * The activity itself is not unsafe nor pose a "security hole" (regardless of your opinions on other non-security effects like liberty)
        * It's effectiveness is in large part subject to it remaining covert
        * Publically reveiling the activity makes it non-covert, and therefore reduces its effectiveness.
        * Result: the "risk" to our safety was increased (again ignoring any other effects for this analogy). There is no obvious way to "undo" this increase in risk (e.g., no forthcoming "patch" which will make it covert once again)
        * If the public exposure had not happened: risk would have remained unchanged (which already was lower than if this activity was not even occuring)

      Exposing Oracle bug publically:

        * The "activity" in this case was a security flaw in deployed software.
        * Thus the "activity" was unsafe.
        * The risk it poses is was dependent upon it remaining undiscovered and without an implemented exploit, or until fixed.
        * Publically reveiling it makes it undiscovered.
        * Result: the risk is temporarily increased--its a race to whether an exploit or a patch is developed first. The risk will actually be decreased when a patch is available and installed.
        * If bug was not publically reveiled: flaw remains in software (proven for at least 3 months); probability of being discovered by "black hats" increases with time, thereby gradually increasing risk.

      Oh, and one other big difference: in the former there were other ways to attempt change without full public disclosure (congressional oversight, etc.) that were not used. In the later other non-public methods of affecting change were attempted first.

      So yes, both acts of publicity result in at least temporary increased risk. But the analogy is otherwise completely broken.

      Sorry, but please save your political arguments to a political topic.

    2. Re:Blame it on the messenger, again by thomasa · · Score: 1

      * The activity itself is not unsafe nor pose a "security hole" (regardless of your opinions on other non-security effects like liberty)

      Baloney. It puts "we the people" at risk by eliminating judicial oversight.

  13. Silly Argument by Oracle by Anonymous Coward · · Score: 0

    What Oracle is saying is analogous to having an overpass bridge that has cracks in it and the DOT getting upset that some citizen told the local TV station about the crack.

    The bridge needs to be fixed or lives might be lost, and everyone has a right to know that.

    In the case of Oracle lives probably won't be lost but there is the potential for lots of businesses to loose large sums of money when an Oracle database gets cracked.

  14. Recall product by Anonymous Coward · · Score: 1, Insightful

    If a vulnerable product cannot be patched in a reasonable timeframe ..

    RECALL THE PRODUCT!

    That's what car makers do.

    And yes, software is critical.

    1. Re:Recall product by Anonymous Coward · · Score: 1, Informative

      >And yes, software is critical.

      When customers such as government agencies and hospitols rely on your product to store their data, it is pretty damned critical. If you were a patient in a hospitol, the database could be life or death to you.

  15. Liability by MikeRT · · Score: 1

    Fine, then what should be a standard legal definition for time limit for liability if they don't fix the bug in a reasonable period of time? If it's severe, they get three months? Other companies have to do product recalls by law if their products fail in a way that is damaging to life or property, so at what point do they have to start making amends to their customers for failure? Kinda funny considering the bravado they had in the past. I guess they got called out and they were all bluster.

  16. Mission critical Info by MSenhanced · · Score: 1

    The simplest answer lies where Oracle needs to provide this sort of information to Oracle DBA's and its users on a "need-to-know" basis whereby you log on to their website and become a paying-member for the latest news, security updates, and services (consenting to a non-disclosure agreement). Oracle can easily get away with this as opposed to Microsoft in the OS market because most people who own Oracle are highly trained and need to know this mission critical information.

    --
    I write sig's like I know what I'm talking about.
  17. ever heard of regression testing? by bobalu · · Score: 3, Interesting

    I mean, gee, it's not like they have to test it on a huge number of platforms or anything right? Much better to rapidly fix the bug and then break a bunch of running code, bringing large businesses down to their knees.

    Yes, the bug puts their customers at risk, but detailing the exploit for everyone to see REALLY DOES HELP THE BAD GUYS. Otherwise they have to figure it out for themselves, which is quite a bit harder.

    --
    The revolution will NOT be televised.
    1. Re:ever heard of regression testing? by Manitcor · · Score: 1

      Who is to say he's the only person that has figured this problem out?

      He's a smart guy, I'm sure, but there are plenty of smart people and not all of them are on the side of actually helping security. For all we know there could be someone else who figured this out and has been exploiting it perhaps in ways that its even undetectable that there has actually been data theft or changes.

      If administrators know about the problem they are better able to guard against it. Either by reconfiguring permissions on the application and(or) database server so that transactions are more restricted, require additional levels of authentication or take the application down altogether. Albeit, in some instances, either work around is unacceptable however it's best that administrators know about the risk so that they may mitigate it.

      Remember, for every smart guy on the white hat side hunting down and reporting security issues there are more smart guy(s) working both independently as well as for less than scrupulous organizations and groups that are also looking for the same weaknesses to exploit as soon as possible because once they become public knowledge those vulnerabilities quickly loose their value.

      --
      "Don't mess with him, he taunts the happy fun ball."
    2. Re:ever heard of regression testing? by morzel · · Score: 2, Insightful
      I mean, gee, it's not like they have to test it on a huge number of platforms or anything right? Much better to rapidly fix the bug and then break a bunch of running code, bringing large businesses down to their knees.
      If you would have read the fine article, you would have known that flaws in this particular piece of code have been discovered over the past few years, with each patch being inadequate in actually fixing it securely. You should think that 4 years would be enough for some regression testing.
      Yes, the bug puts their customers at risk, but detailing the exploit for everyone to see REALLY DOES HELP THE BAD GUYS. Otherwise they have to figure it out for themselves, which is quite a bit harder.
      The author of the report detailing the exploit also includes a workaround, which enables administrators to have some kind of protection. The bad guys as you call them were already all over this due to the history of security issues in that piece of code. In this case, I see more value in letting the customers know that their machines are at risk than telling something that the bad guys most probably already knew.
      --
      Okay... I'll do the stupid things first, then you shy people follow.
      [Zappa]
    3. Re:ever heard of regression testing? by Manitcor · · Score: 1

      Replying to myself, I know.

      As a side note I work in the SOA and Web Application Server space as a developer. I know quite well how Oracle's app server works. When it initially came out it was merely a bunch of triggers and stored procedures that spit out HTML over a designated port.

      Customers complained that it was a pain to extend as it did not support any major development platform (Java, .Net, etc). Oracle responded by overlaying an apache app server with a simple Java based framework that for the most part were just wrappers for said stored procedures. When I first saw the new setup I thought to my self that this may be an issue with the application layer tied so closely to the data layer (never build an application to an individual data store type) however I didn't really intestate it much. I don't think it would be much of a leap for someone with the time, knowledge and desire to think of that and then begin digging for vulnerabilities.

      --
      "Don't mess with him, he taunts the happy fun ball."
    4. Re:ever heard of regression testing? by Fishstick · · Score: 1

      I didn't see a detail of the exploit, but I did see a detail workaround:

      The workaround is trivial; using mod_rewrite, which is compiled into
      Oracle's Apache distribution it is possible to stop the attack. The
      workaround checks a user's web request for the presence of a right facing
      bracket, ')'.

      Add the following four lines to your http.conf file then stop and restart
      the web server

      RewriteEngine on
      RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
      RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempted-attack
      RewriteRule ^.*\).*|.*%29.*$ http://127.0.0.1/denied.htm?attempted-attack

      --

      There is much cruelty in the universe, John.
      Yeah, we seem to have the tour map.

  18. Lesson #1: Do NOT Feed the Bears by mpapet · · Score: 1

    This example highlights how institutions (gov't corps) long ago superceded the individual in terms of credibility on an unconcious level. Oracle today, Cisco a few months ago. Years ago there was a guy doing research on censorware. I recall that guy maintains he's a "victim" of the DMCA. You need more proof? All the moral outrage about this guy on /. and no action. Nothing.

    Just one lesson to learn here is there needs to be some kind of standard procedure for notifying and working with companies with flawed software.

    The idea being the individual conforms to a SOP and if the corporation hasn't done their part at some point, then the flaw can be responsibly published. It would give more strength and accountability to individuals. Much in the way a medical doctors use SOP's to indemnify themselves in malpractice situations.

    Is there anything like it out there for security research?

    --
    http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
    1. Re:Lesson #1: Do NOT Feed the Bears by rbochan · · Score: 1

      Bears?

      godless killing machines without a soul

      Oh wait, this is Oracle...

      --
      ...Rob
      The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
  19. It's not a fundamental bug by Anonymous Coward · · Score: 2, Insightful

    While the posing doesn't explain the vulnerability in detail, you can see from the fix that it's inadequate input validation, which is easy to add. There's an access control mechanism that's supposed to prevent access to certain features from the web interface, and it's not doing its job.

    While sometimes there are fundamental design problems, this doesn't look like such a case.

    (And in such a case, you should explain to the problem reporter why this is an exceptionally difficult bug and ask for an exceptionally long time before disclosure.)

  20. Pot vs. Kettle by dmccarty · · Score: 1
    What David Litchfield has done is put our customers at risk.

    It would seem to me that what put Oracle's customers at risk was the security flaw itself, not someone's disclosure of it.

    --
    Have fun: Join D.N.A. (National Dyslexics Association)
  21. Gartner by imipak · · Score: 1
    As well as the groundswell of anger and resentment building up against Oracle (who were already notorious for charging the earth for crappy products, of which only the flagship database offers anything you can't get elsewhere - and even then, the RDBMS hardkore out there will tell you that very very few places use those features) - it's interesting to note that even Gartner, friend of the PHB everywhere, have turned on their erstwhile prize vendor.

    http://news.com.com/Gartner+Oracle+no+longer+a+bas tion+of+security/2100-7355_3-6030733.html

    1. Re:Gartner by lbalbalba · · Score: 0

      See http://www.gartner.com/DisplayDocument?doc_cd=1374 77 for details.

  22. so who will sue Oracle? by Anonymous Coward · · Score: 0

    ...for false advertising. Oracle routinely advertises their product as "unbreakable".

    Sounds open & shut to me!

  23. Unbreakable by Dan512 · · Score: 1

    Indeed.

  24. THIS JUST IN... by MustardMan · · Score: 1

    Breaking news... pot calls kettle black. Film at 11.

  25. Product Recall by Anonymous Coward · · Score: 0

    What's product recalls for? Better than having a potentially massive attack vector wide open for months or years.

  26. I agree with Oracle on this by dilvish_the_damned · · Score: 1

    What David Litchfield has done is put our customers at risk
    After all, it *is* best practice to kill the messenger.

    --
    I think you underestimate just how much I just dont care.
  27. Ora ... who? by Kaz+Kylheku · · Score: 1

    :)

  28. Early disclosure by Anonymous Coward · · Score: 0

    In these security-related articles, the question of independent researchers releasing the details of a flaw publicly before the company has released a patch for it always comes up, and the industry always blames the security researchers for doing this. I think this is based on a very flawed premise: The assumption that the person who just disclosed the bug was the first to find it, and that malicious users can't exploit a bug until it's been publicly exposed. If a vulnerability for Foo OS 1.5 to 1.8 is discovered in 2005, and Foo OS 1.5 was released in 2002, then that bug has been around for three years, and at any point in that time malicious hackers could have discovered the bug and started exploiting it. The clock doesn't begin when the benevolent independent research firm finds the bug. It would be paranoia to assume that every published security flaw has been actively exploited since it existed, but it is wishful thinking to assume what the industry seems to now.

  29. Not a rdbms vulnerability, per se by Fishstick · · Score: 1
    but a hole in OHS (Oracle's distributed Apache server).

    There's a critical flaw in the Oracle PLSQL Gateway, a component of iAS, OAS
    and the Oracle HTTP Server, that allows attackers to bypass the
    PLSQLExclusion list and gain access to "excluded" packages and procedures.
    This can be exploited by an attacker to gain full DBA control of the backend
    database server through the web server.

    This flaw was reported to Oracle on the 26th of October 2005. On November
    the 7th NGS alerted NISCC (http://www.niscc.gov.uk/ to the problem. It was
    hoped that due to the severity of the problem that Oracle would release a
    fix or a workaround for this in the January 2006 Critical Patch Update. They
    failed to do so.

    There is even a simple workaround:


    The workaround is trivial; using mod_rewrite, which is compiled into
    Oracle's Apache distribution it is possible to stop the attack. The
    workaround checks a user's web request for the presence of a right facing
    bracket, ')'.

    Add the following four lines to your http.conf file then stop and restart
    the web server

    RewriteEngine on
    RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
    RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempted-attack
    RewriteRule ^.*\).*|.*%29.*$ http://127.0.0.1/denied.htm?attempted-attack


    I've already applied this on my OAS install on by development box and I'm ready to spend the next couple hours testing before recommending that we do this on our production box.

    I don't think leaving their customers vulnerable for another 3 months (or
    perhaps even longer) until the next CPU is reasonable especially when this
    bug is so easy to fix and easy to workaround. Again, I urge all Oracle
    customers to get on the 'phone to Oracle and demand the respect you paid
    for

    I couldn't agree more. Can't fathom why they couldn't have notified customers (even if they couldn't have fixed mod_plsql through the CPU), or why they are going after the guy when he told them about this 3 months ago and waited for the January update before getting impatient and going public.
    --

    There is much cruelty in the universe, John.
    Yeah, we seem to have the tour map.

  30. the mere fact by TheDoctorWho · · Score: 0

    that a machine is plugged into a wall will account for a security breach
    let's get worked up digg.com
    Turn off, tune out, unplug.

  31. people need to be realistic by SethJohnson · · Score: 0, Troll

    Why doesn't Oracle just acknowledge the problem and then fix it?

    Oracle's DB products are unbelievably complex pieces of code which support tens of thousands of dependencies from other pieces of code, many of which weren't even created by Oracle. It's not as simple as, "Hey. Let's throw this patch out on our website and tell everyone to install it."

    This dude shows up with some kind of exploit and then has the gall to dictate to Oracle what their bugfix release schedule should be?!? That's a real narrow view of the situation. Not only are they having to design a fix for the exploit in the current version, but they have to ensure it doesn't conflict with their future versions currently in development. And then they have to do regression testing to ensure it doesn't break dependencies. And then they gotta give it out to their customers who will also be running the same kind of regression tests before they deploy the patch to their live servers.

    As an Oracle customer, I'd prefer that they release cumulative fixes on an established schedule rather than ring a Defcon 1 alarm whenever someone finds a bug that may not even impact my installation. Releasing patches as one-off fixes causes more headache for the customer in repetitive testing. As it is, Oracle publishes bugfixes quarterly, and they probably didn't have time to fit this fix into their testing matrix, etc. by the time they were notified of the problem. They also probably evaluated the bug and determined it didn't pose that much of a risk.

    I'm not saying Oracle customers shouldn't demand quick turnarounds on bugfixes, but this guy kind of comes across as a control-freak who wanted to make a big corporation jump through a hoop and when they didn't, he went crybabying to securityfocus.

    Seth

    --
    $5 / month hosted VPS on linux = awesome!
    1. Re:people need to be realistic by lewp · · Score: 1
      I'm not saying Oracle customers shouldn't demand quick turnarounds on bugfixes, but this guy kind of comes across as a control-freak who wanted to make a big corporation jump through a hoop and when they didn't, he went crybabying to securityfocus.

      More likely he wanted to publish the results of his research, since that would be the reason why he did the research in the first place. He wasn't trying to make Oracle jump through a hoop by releasing this info three months after he told them about it, he was doing them -- and, indirectly, as a customer of Oracle's, you -- a courtesy by giving them three months to fix it before telling anyone else in the first place.

      --
      Game... blouses.
    2. Re:people need to be realistic by ahmusch · · Score: 1

      Remember, this is Slashdot. Big Company Bad.

      Of course, if you have an Oracle database running on a server in the wild that's vulnerable to this exposure, you're an idiot considering this vulnerability was known about months ago.

      But none of that is relevant. If Big Company doesn't respond according to Slashdot's time constraints -- and right sprightly, too! -- well, they're evil. Actually more evil because they have wealth, power, and greater marketshare than all the OSS database engines, which is evil, as well as because they dared ship code which was discovered to have a vulnerability, which is even eviler.

  32. Heroes, my things have changed... by micromuncher · · Score: 1

    When I was at university, there was a program publishing confidential information to /tmp with read all access. I alerted the system administrators and officials, and they said thanks, they'd fix it.

    A few months later, I noticed the same stuff getting generated, so I complained, and was told that it was fixed.

    So I posted the information in an adminstrators newsgroup.

    Suffices to say, I was BAD for publishing confidential information. I got my privs removed, threatened with expulsion, but hey, the problem was fixed.

    So how does this apply to oracle in my experience? "Bad" researcher for not working with the company to fix the problem and rushing to prove a point. "Bad" company for not addressing the issue properly when they were first made aware of it.

    But its kind of strange these days how publishing information on how to break systems, or providing shoot from the hip fixes (meta files anyone) makes instant Heroes, when in the past this kind of egotistical self gratifying behavior typically generated a reprimand.

    I admit, in my case, my thumb was on my nose when I did my public naughtiness. Least I grew up...

    --
    /\/\icro/\/\uncher
  33. The Emperor is stark raving naked... by Anonymous Coward · · Score: 0

    Indeed! How dare anyone ever tell the emperor his butt is hanging out in the breeze... and his little pee-pee too. Whoever discloses such things, OFF WITH THEIR HEADS!

  34. Rather than denigrate Litchfield... by emil · · Score: 1

    ...Oracle should contact him immediately, and determine any schedule he may have on revealing further security flaws.

    I assume that Litchfield has additional bombshell revelations in store, and it is obvious that he has run out of patience.

    Oracle should be silent on criticism of Litchfield, and they should quickly triage which problems they intend to solve, and when.

    p.s. Oracle should also stop distributing Apache. Their version has more holes than swiss cheese.

  35. Full-Disclosure by rbochan · · Score: 1

    We believe in it.

    --
    ...Rob
    The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
  36. not defending Oracle but... by Anonymous Coward · · Score: 0

    this does seem to be a bit exagerrated.

    how does the compromised IAS server get a database session w/DBA? if IAS is connected to database as user w/DBA then sure but that's a pretty stupid configuration. is it possible to get a session as a user w/DBA w/o one of the following being true:

    1. the IAS server was already configured to connect to database as user w/DBA (dumb)
    2. IAS is running on same server/user as DB instance (uber-dumb)
    3. sys/system (/apps for ERP) passwords not changed from defaults (no words for this)

    if not it's still bad but somewhat exaggerated. if so then gentlemen, start your flamethrowers!

    full disclosure: my spouse is a sales consultant at Oracle but trust me, I don't hesitate to criticize them when warranted.

  37. there are two kinds of posts in this forum... by hobo+sapiens · · Score: 1

    ...the ones that all say the same thing about Oracle putting their customer at risk and people complaining about all of the redundant comments. Jeez!!! What, did the Borg just invade /. or something?!


    --
    I am not an actor but I play one on TV

    --
    blah blah blah
  38. ... or just a chance to bash security researchers? by CaptKeen · · Score: 1
    Interestingly enough, I saw Litchfield's post to Bugtraq on this issue. He did not disclose any 'real' information (compared to other posts detailing what problems are and where they are, or even proof of concept exploit code) about the vulnerability that would lead to a compromise, unless you already knew what the compromise was. He did post a workaround, which was an Apache mod_redirect config which catches the attack and rewrites the URI to the denied page.

    But, hey, I'll let you all judge. Here's his posting to Bugtraq:


    There's a critical flaw in the Oracle PLSQL Gateway, a component of iAS, OAS
    and the Oracle HTTP Server, that allows attackers to bypass the
    PLSQLExclusion list and gain access to "excluded" packages and procedures.
    This can be exploited by an attacker to gain full DBA control of the backend
    database server through the web server.

    This flaw was reported to Oracle on the 26th of October 2005. On November
    the 7th NGS alerted NISCC (http://www.niscc.gov.uk/ to the problem. It was
    hoped that due to the severity of the problem that Oracle would release a
    fix or a workaround for this in the January 2006 Critical Patch Update. They
    failed to do so.

    The workaround is trivial; using mod_rewrite, which is compiled into
    Oracle's Apache distribution it is possible to stop the attack. The
    workaround checks a user's web request for the presence of a right facing
    bracket, ')'.

    Add the following four lines to your http.conf file then stop and restart
    the web server

    RewriteEngine on
    RewriteCond %{QUERY_STRING} ^.*\).*|.*%29.*$
    RewriteRule ^.*$ http://127.0.0.1/denied.htm?attempted-attack
    RewriteRule ^.*\).*|.*%29.*$ http://127.0.0.1/denied.htm?attempted-attack

    I don't think leaving their customers vulnerable for another 3 months (or
    perhaps even longer) until the next CPU is reasonable especially when this
    bug is so easy to fix and easy to workaround. Again, I urge all Oracle
    customers to get on the 'phone to Oracle and demand the respect you paid
    for.

    Cheers,
    David Litchfield

    --
    --
  39. no agenda here by digitaldc · · Score: 1

    Sorry, but please save your political arguments to a political topic

    What I was trying to say was that people can criticize something without having fear or being intimidated from speaking up. I have no political agenda here except free thought and speech.

    --
    He who knows best knows how little he knows. - Thomas Jefferson
  40. So, IF I report a fire by Jerry · · Score: 1

    am I putting citizens at risk too?

    According to Oracle's way of thinking I am. So, I should NOT warn those in danger and just secretly call the Fire Department?

    How lame does Oracle think people are... well, just as lame as Microsoft thinks they are. And they must be. Look how many put up with hole after hole after hole, and even defend MS on the blogs for not fixing holes.

    People get EXACTLY what they allow, or worse.

    --

    Running with Linux for over 20 years!

    1. Re:So, IF I report a fire by rbarreira · · Score: 1

      Bad analogy. It would be more like you publically saying that it's easy to set the white house on fire, instead of just warning a few select authorities.

      --

      The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F
  41. Networked DB? by PhYrE2k · · Score: 1

    Plain any simple, any Database directly accessable to the open world with a nice public IP or no filtering is clearly run by idiots. Agreed a slow response is a slow response, but it's like a local exploit on a low-volume internal machine... the response is 'when you get around to it'.

    -M

  42. Gartner Research agrees by lbalbalba · · Score: 0

    And for once, the more 'traditional' analysts (Gartner, in this case) actually agree with the security experts : " ... the range and seriousness of the vulnerabilities patched in this update cause us great concern. The database products alone include 37 vulnerabilities, many rated as easily exploitable and some potentially allowing remote database access See http://www.gartner.com/DisplayDocument?doc_cd=1374 77 for details.

  43. Solid Spin, Oracle! by sweganeer · · Score: 1

    Ah, right, Oracle. This is how your customers read your spin, though: "We [customers] are always disappointed when [Oracle] feel[s] the need to [place blame] before a fix is available... What [Oracle] has done is [ensure we are not] at risk[ - only if third parties shut up, heed its whining, and play nicely!]" Oracle makes the point itself: its customers are at risk - period. ...too bad Oracle's hot air hasn't lifted a fix off the ground yet!