Oracle-L: Re: 02/11/2003 security alerts

From: Ray Stell <stellr_at_cns.vt.edu>
Date: Fri, 14 Feb 2003 13:29:21 -0800
Message-ID: <F001.0054E3EB.20030214132921@fatcity.com>

I downloaded some of these interim patches. Fortunately for me, the software needed to apply the patch is not included in the distribution. The readme points to Oracle9i Data Server Interim Patch Installation (OPatch) Doc ID: 189489.1, which says:

"An Interim Patch is tested by itself but no system regression testing is done until it is included in the next Patch Set. Because of this, it is highly recommended that all customers needing bug fixes wait for a Patch Set or product release that includes the fix."

and

"The fix in each Interim Patch is a separate and unique branch off the base code line and does not automatically include other fixes made since the last baseline. Oracle does this to minimize the risk that a patch will have unexpected side effects. Because of this it is possible that a particular Interim Patch could cancel out a previously installed Interim Patch."

I find this approach to system security reprehensible.

I count 6 outstanding security related patches since the last patchset, 9.2.0.2.
I don't believe there will be a patchset beyond 8.1.7.4 and there are outstanding holes. That means I have to apply the one-off, untested patches to production services.
There is no point in releasing the advisory if there is no action that they "suggest" you take.
When do you know when you need to apply a interim security patch? Would that be before or after the system is hacked?

Oracle Corp.: You take the blue pill and the story ends. You wake in your bed and you believe whatever you want to believe.

Have a nice weekend.

On Thu, Feb 13, 2003 at 02:11:48PM -0800, Ray Stell wrote:
>
> http://otn.oracle.com/deploy/security/alerts.htm

Ray Stell stellr_at_vt.edu (540) 231-4109 KE4TJC 28^D

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: Ray Stell
  INET: stellr_at_cns.vt.edu

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).

Received on Fri Feb 14 2003 - 15:29:21 CST