[ISN] Oracle no longer a 'bastion of security': Gartner

[InfoSec News]

http://www.zdnet.com.au/news/security/soa/Oracle_no_longer_a_bastion_of_security_Gartner/0,2000061744,39234277,00.htm

By Munir Kotadia
ZDNet Australia
24 January 2006

Analyst group Gartner has warned administrators to be "more
aggressive" when protecting their Oracle applications because they are
not getting enough help from the database giant.

Gartner published an advisory on its Web site just days after Oracle's
latest quarterly patch cycle, which included a total of 103 fixes with
37 related to flaws in the company's database products. Some of the
flaws carry Oracle's most serious rating, which means they're easy to
exploit and an attack can have a wide impact.

According to the advisory, which was posted by Gartner analyst Rich
Mogull on Monday, "the range and seriousness of the vulnerabilities
patched in this update cause us great concern.
 Oracle has not yet
experienced a mass security exploit, but this does not mean that one
will never occur."

Mogull said that because Oracle has historically been seen as having
very strong security and many of Oracle's products are located "deep
within the enterprise", administrators often neglect their patching
duties.

"Moreover, patching is sometimes impossible, due to ties to legacy
versions that Oracle no longer supports. These practices are no longer
acceptable," said Mogull who advises administrators to pay more
attention to securing their Oracle applications.

Mogull said administrators should:

* Immediately shield these systems as well as possible, using
  firewalls, intrusion prevention systems and other technologies.

* Apply available patches as rapidly as possible.

* Use alternative security tools, such as activity-monitoring
  technologies, to detect unusual activity.

* Pressure Oracle to change its security management practices.

In response to the Oracle patch release, Symantec raised its ThreatCon
global threat index to Level 2, which means an outbreak is expected.  
It typically does that after a patch release because malicious hackers
might use the fixes as a blueprint for attacks.

CNET News.com's Joris Evers contributed to this report

Copyright © 2006 CNET Networks, Inc.