3400 Bridge Parkway, Suite 101
94065 Redwood Shores, CA, us
+44 (20) 71832-841
Imperva CTO's perspective on the July 2011 Oracle CPU
I have three observations: First, this is a good-sized set of patches for both general Oracle products and in particular the database. Here, you can see the Oracle vulnerability volume per CPU.
Second, for this release, and historically, the security scoring clearly doesn't always reflect the true operational risk. For example, CVE-2011-2253 is rated as a 7.1 on the severity scale (CVSS score). However, it requires privileged SYSDBA to abuse this vulnerability which would place this problem much lower on most security professional's priority list. Consequently, this should be scored lower. By contrast, CVE-2011-0835 and CVE-2011-0880, allow you to take over the entire database with just a valid set of credentials yet scores much lower at 6.5. Unfortunately, given the pervasiveness of the Oracle database, mislabelling the security impact of vulnerabilities can adversely affect the risk management process.
Third, with JRockit and Oracle Secure Backup, we see serious security problems with these products-again. These products are notorious for producing severe vulnerabilities. In this case, CVE-2011-0873 and CVE-2011-2261, each received a CVSS score of 10. The lesson? Oracle should take a closer look at the security of these products as their poor track record may indicate a deeper, systemic security problem."
The use of information published here for personal information and editorial processing is generally free of charge. Please clarify any copyright issues with the stated publisher before further use. In the event of publication, please send a specimen copy to firstname.lastname@example.org.