I don't think leaving their customers vulnerable for another 3 months (or perhaps even longer) until the next CPU [Critical Patch Update] is reasonable especially when this bug is so easy to fix and easy to workaround. Again, I urge all Oracle customers to get on the phone to Oracle and demand the respect you paid for. |
It's quite astonishing how backwards they are in their approach to security. |
On November 7 NGS alerted NISCC to the problem. It was hoped that due to the severity of the problem that Oracle would release a fix or a workaround for this in the January 2006 Critical Patch Update. They failed to do so. |
Oracle still has not released an official patch, so it is still leaving its customers at risk. It is a trivial thing to fix. If the company is still working on it, I do not understand why. |
Someone can come in off the Internet over the Web without a user ID or password and interact with the back-end database server, so it goes through all the firewalls. This is critical. |
SQL injection is probably today's biggest security issue. This problem has been known about for years, but seven out of ten Web applications are still vulnerable. I find it extremely frustrating. |
The whole point of a regular patch cycle is that people can plan ahead and install once. But if you are having to install it nine times, where's the benefit of that? |
They are well behind the curve at the moment. |
This is a very critical issue and it's disappointing that Oracle hasn't fixed it, especially since the workaround is rather simple. |
This specific flaw was reported to Oracle on the 19th of February 2006. |
We disclosed this to Oracle on Oct. 25 last year. Around the same time, they were alerted to another high-risk flaw that is not as serious as this one. They fixed that one in the January CPU but neglected to fix this. It's not a case of not having enough time, because the fix is trivial and the risks are severe. |