Slashdot Mirror
Oracle Plugs 122 Security Holes
Aditi.Tuteja writes "Oracle has released a 'critical patch update' that plugs 122 security vulnerabilities across the company's databases, enterprise applications, developer tools and middleware. Oracle has also started providing additional information indicating whether a flaw can be exploited by remote attackers without any authentication credentials.
But, Oracle has failed to deliver its patches on all platforms. Patches for Oracle databases 9.2.0.6 and 10.1.0.5 will not be available until the end of this month. Users running Oracle 10.2.0.1 on Linux on Power servers will also have to wait until the end of October, as will users running Oracle 10.2.0.2 on Windows."
I, for one, welcome our hole plugging overlords...erm...wait...no...
So for every month of the past year, it's safe to assume that Oracle had between 50-100 open vulnerabilities.
Rhetorical question: How many did PostgreSQL or MySQL have open during any of those months?
troll? I chuckled. At least until I realized I'm still emotionally scarred from years ago when I clicked said link wondering "what's this?"
Odd to see almost all posts before mine are flamebait/troll. Anyway, congrats to Oracle for patching that stuff. You don't see bugfixes like that very often anymore.
So I guess they're not still flaunting Oracle as being unbreakable?
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Nice post, nacturation (646836).
Business only understands one thing: money. So this needs to cost them money.
So to me the solution is simple: Researchers privately disclose bugs to the vendor along with a Public Release Date....maybe 6-weeks in the future. Non-Negotiable.
Fixed or not*, the bug is fully and publicly disclosed on that date. Since OSS (and MS DRM! heheh) has shown that bugs can be fixed in days or at the most a few weeks this should give a motivated company plenty of time to fix it. And only money motivates a business.
When vendors start getting threatning calls/letters from their customers (either to sue or jump ship) due to unpatched exploits that are public knowledge then they will be forced to fix them.
Oh sure, the vendors will cry foul (and sadly some will probably try and sue researchers instead of fixing their problems) but the fact is that if one person can find an exploit then a second person can find this exploit. And the other guy might not have noble intentions. Every day that a findable exploit exists is a day that the system is at risk...
*This is actually important, b/c if you read the rant you'll note that the 'fixes' are half-assed. I'm pretty confident that if the exploit was going to be made public that the fixes would be more robust...or the company will go bust.
If you think imaginary property and real property are the same, when does your house become public domain?
I agree with you except for one point: 6 weeks is much too long. The correct time to wait is zero days. Here's why:
1. Vendors need an incentive to write bug free code. If vendors know that they can get away with sell-then-patch, they will do just that. But if bugs mean public exploits, angry users, and bad press, they will spend more money on security.
2. Black hats often have the security hole before you. So you're not doing the vendors much of a favor by giving them six weeks; you're just shielding them from bad press.
3. It is unfair to the user. Given #2, those six weeks are six more weeks that a user is susceptible to damage without any chance at turning off the service, reconfiguring it, putting up a firewall, changing passwords, and otherwise mitigating any potential problems. Remember, the bug is the vendor's fault, but it's the user that ends up hurting the most.
Full, immediate, public disclosure is only rational option.
Zero days of notification also gives the vendor less time to file the lawsuit to stop you. Perhaps it's prudent to do it anonymously as well.
Shouldn't your sig be
Chuck Norris on email "I told you, I'm a fucktard from the wild west. I write by hand as I'm too stupid to even exisdt let alone use a computer"
GO AHEAD, FUCKING FLAME AWAY OR WASTE YOUR GODDAMNED MOD POINTS FUCKTARDED SHITDOT SHEEPLE!!!
However I can't agree to a zero-day release since for any given bug that is found by a researcher there is a probability less than 100% that the Bad Man finds it and begins to use to to exploit systems. If the researcher releases then it's safe to assume there is a 100% probability that the Bad Man knows about it and attempts to make use of it. Finding unprotected systems is just a numbers-game. Not every shop will have read the exploit or have been able to determine whether or not they are vulnerable. Consider time-zones alone, let alone over-worked sysadmins with other existing priorities! And this is why zero-day exploits are so dangerous...and zero-day exploits is exactly what you're describing.
However I fully agree that it's the end-user that suffers here (and that was the reason for my initial post!) and perhaps 6-weeks is too long, but for sure 0-days is too short.
Perhaps a shorter duration before full public disclosure, and if/where the researcher can see a work-around, release minimal info along with suggested action on the 0-day time-line. This won't work for every situation, but where possible might be a good middle ground...
If you think imaginary property and real property are the same, when does your house become public domain?