Oracle flags up 52 security flaws

Oracle has revealed 52 critical updates in its first pre-release security patch announcement

Oracle has issued its first pre-release security patch announcement, flagging up no fewer than 52 critical updates, just as a security company has highlighted the vulnerability of many databases.

However, security firm Secerno warned that weaknesses in the development process are often more serious than any vendor vulnerabilities.

"This is another step in the right direction by Oracle. As ever, forewarned is forearmed and this move allows IT managers to get to grips earlier with essential patching," said Secerno chief executive Paul Davie.

"But users need to beware that it is not the vendor vulnerabilities that they need to focus on, but the critical weaknesses in their development processes."

Vulnerabilities in vendor solutions can be mitigated to some extent by timely patching, but users cannot rely on patch management to solve database security problems, according to Davie.

Secerno believes that the continuous pressure on developers to drag more and more functionality out of their database should be a much greater cause for concern.

Deployment errors caused by poorly configured databases, inappropriate access permissions or badly engineered applications accessing the database are an increasingly worrying trend.

Davie believes that badly written web applications are a key cause for concern and are responsible for more than 60 per cent of attacks.

Secerno uses machine learning algorithms to allow users to build up a 'rich' understanding of application-to-database behaviour and to insist on database interactions conforming only to allowable behaviours.

This approach is not constrained by the usual black list/white list approach which prevents traditional tools from dealing effectively with previously unseen zero-day attacks or specifically crafted SQL injections, the company said.

• Oracle Critical Patch Update Pre-Release Announcement - January 2007
• Oracle to issue pre-release patch info