Oracle Accused Of Downplaying Severity Of Database Security Flaws

Even as Oracle fixed numerous flaws across multiple products in January’s Critical Patch Update (CPU), security experts criticised the company for the low number of database fixes and claimed the company is downplaying the severity of a flaw in its flagship relational database.

Only two patches were for the Oracle Database out of the 78 security fixes in the January update, which also covered the Oracle Fusion Middleware, Oracle e-Business Suite, Oracle Supply Chain, Oracle PeopleSoft, Oracle JDEdwards, Oracle Sun products, Oracle Virtualization and Oracle MySQL, the company said in its CPU advisory.

“Either the database server has reached an amazing maturity in terms of security or Oracle did not have enough resources to include more fixes into the process,” Amichai Shulman, CTO of Imperva, told eWEEK.

Patch bottleneck

As Oracle expands its product portfolio and increases the total number of products patched through the quarterly CPU, there appears to be a “bottleneck” in Oracle’s patching process, Shulman said. This CPU was the first time Oracle included the open-source MySQL database, which it acquired in 2010 as part of the Sun Microsystems acquisition.

While MySQL accounted for a whopping 27 fixes, the overall number of vulnerabilities in the CPU remained consistent with previous releases, according to Shulman. “If you were to introduce a new product, there should be more vulnerabilities in the CPU,” he said.

The low number of Oracle database fixes is most likely a sign of Oracle shifting its focus and “de-emphasising” the entire database line, Alex Rothacker, director of security research at Application Security’s TeamShatter, told eWEEK. Oracle has been consistently decreasing the number of database-related fixes in its CPU since January 2010, shortly after the Sun deal closed, he said. The company released only 34 fixes for Oracle Database Server in all of 2011.

Of the nine reported vulnerabilities TeamShatter has open with Oracle, several of them are “at least as severe as those that were fixed in this CPU”, Rothacker said.

Oracle claimed there were fewer issues to fix in its software. The Oracle Database Server code has “matured”, and many of the vulnerabilities have been weeded out, Eric Maurice, director of Oracle’s security assurance programme, wrote in the Oracle Software Security Assurance blog on 15 December.

Secure practices

Oracle has also introduced a secure coding initiative, similar to Microsoft’s Security Development Lifecycle, which has resulted in fewer bugs in new code, according to Maurice.

Unless circumstances change drastically – as a result of, for example, the discovery of new exploit vectors – we expect that the number of Oracle Database Server vulnerabilities fixed in each Critical Patch Update will remain at a relatively lower level than previously experienced,” Maurice wrote.

Although Oracle is telling customers the database platform is secure because fewer flaws are being found, that “just isn’t the case”, according to Rothacker. TeamShatter continues to report a similar number of vulnerabilities, but Oracle is fixing fewer of them, he said. “By fixing less, they are leading people to believe they are more secure,” Rothacker said.

Oracle is also continuing to “undervalue the severity of their reported vulnerabilities”, Shulman said, noting that a Solaris vulnerability fixed in this CPU had a Common Vulnerability Scoring System rating of 7.8, but similar issues in the Oracle Database Server and MySQL scored “just a 5.5”.

The vulnerability in the Database Server’s Core RDBMS component (CVE-2012-0082), with its 5.5 CVSS rating, is “probably more severe” than Oracle made it sound in the advisory, Rothacker said. The issue affects Oracle Database versions 10.1.05 to 11.2.0.3 and was a “flaw in Oracle’s flagship database software that could have serious repercussions for Oracle database customers, potentially compromising the security and stability of Oracle database systems”, InfoWorld reported.

Changing numbers

Oracle uses the System Change Number to keep track of database activity, including inserts, updates and deletes into the tables, and it is necessary for the database to properly return the appropriate version of data at any given point in time. InfoWorld disclosed to Oracle several ways the SCN can be artificially incremented, causing the database to become unstable or unavailable.

While the flaw could make any unpatched Oracle Database customer vulnerable to malicious attack, the “more fundamental aspect” of the issue poses “a special risk only to large Oracle customers with interconnected databases”, according to InfoWorld.

The side effects for this fix “could be difficult to implement at all customer sites”, Rothacker said.

The SCN issue is a good example of how Oracle’s “Partial+” ranking “artificially plays down the severity” of the vulnerability, Shulman said.

According to Oracle, a vulnerability’s impact is only considered “Complete” if “all software running on the machine” is affected, not just the Oracle Database Server. If the issue impacts just the database server, the company rates it as “Partial+” to indicate it was more serious than other issues with just a “Partial” rating. This distinction defies “common sense” because in most real-world installations, the database server is the sole software running on a given computer besides the operating system, according to Rothacker.

Oracle should rethink its Partial+ ranking, Shulman said.