Gartner published an advisory on its Web site just days after Oracle's latest quarterly patch cycle, which included a total of 103 fixes with 37 related to flaws in the company's database products. Some of the flaws carry Oracle's most serious rating, which means they're easy to exploit and an attack can have a wide impact.
According to the advisory, which was posted by Gartner analyst Rich Mogull on Monday, "the range and seriousness of the vulnerabilities patched in this update cause us great concern.… Oracle has not yet experienced a mass security exploit, but this does not mean that one will never occur."
Mogull said that because Oracle has historically been seen as having very strong security and many of Oracle's products are located "deep within the enterprise", administrators often neglect their patching duties.
"Moreover, patching is sometimes impossible, due to ties to legacy versions that Oracle no longer supports. These practices are no longer acceptable," said Mogull who advises administrators to pay more attention to securing their Oracle applications.
Mogull said administrators should:
• Immediately shield these systems as well as possible, using firewalls, intrusion prevention systems and other technologies.
• Apply available patches as rapidly as possible.
• Use alternative security tools, such as activity-monitoring technologies, to detect unusual activity.
• Pressure Oracle to change its security management practices.
In response to the Oracle patch release, Symantec raised its ThreatCon global threat index to Level 2, which means an outbreak is expected. It typically does that after a patch release because malicious hackers might use the fixes as a blueprint for attacks.
CNET News.com's Joris Evers contributed to this report
Whilst we continue to base high level and confidential information on PC Servers we will never get away from the potential threat of Virus and Spyware attacks to name a few.
Whilst we continue to base our distribution of such Databases via insecure comms protocols that we cannot control and are inadequate from the grass roots up- we will never have control.
Consider a Main Frame. We all remember those. They were capable of 100s and thousands of transactions per second, were imine to Virus and Spyware and we secured their distribution via secure comms.
Perhaps there is still a role to play for the Mainframe, and whilst I won’t deny it takes a people to keep it running and program development takes longer - we must ask ourselves. IS the cost of security and the potential for disaster measurable by cost? I think not.
In 1970 the US Military in experiments wit then Bell Labs abandoned the use of TCP/IP as a collection of protocols and it was subject to too much potential abuse and not securely manageable.
Then we sere sold the PC based Networks as the answer to all times in development and change.
We are all not paying the price for a horrible misguided sense of securing and insecure protocols and PC based Server Networks which are just as vulnerable to massive threats.
We were sold these answers to the worlds need for more flexible Data manipulation and we no longer had to put any money toward development. We just run down the store and pick up the box of new software and trust in its current design that someone else tells us it’s safe.
Let’s go back to secure operating systems and secure protocols and put money we spend on security back into in-house development – the next generation may thank us.