Oracle Lax on Latest Zero-Day Vulnerability
IDefense Labs is reporting on an unpatched vulnerability in the Oracle 10g XDB package:
Exploitation of this vulnerability allows an authenticated remote user to execute code on the underlying system in the context of the database account. Other than access to execute the vulnerable function, this vulnerability does not require any special privileges. From the database user account, an attacker can then access or modify the database and files related to its operation.
Oracle's response basically boils down to "Yea, we know, we fixed it, we'll release the patch when we get to it." Thanks, that's a big help.
Oracle doesn't have the best reputation when it comes to security and this makes it seem like they want to claim the title of most disinterested vendor when it comes to security. One way to avoid this perception is to change the patch policy. When a vulnerability is found that allows for arbitrary code execution in the database and proof of concept code is available on line, then patch as soon as possible.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
