MIME-Version: 1.0
From: Patrice sur GMail <patrice.boivin@gmail.com>
Date: Fri, 6 Jun 2014 13:43:08 -0300
Message-ID: <CACH2EDKq8Bq_gfm3LGJNKgqT6EVjTcRd=gzFZyF1waqUGLo6Xg@mail.gmail.com>
Subject: CVEs and Oracle products
To: ORACLE-L <oracle-l@freelists.org>
Content-Type: multipart/alternative; boundary=001a11c3c8c4d2111e04fb2d90da
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-To: patrice.boivin@gmail.com
--001a11c3c8c4d2111e04fb2d90da
Content-Type: text/plain; charset=UTF-8

I was wondering, does Oracle have a CVE equivalency database that would let
us enter a CVE and find out if it applies to any Oracle products and what
versions, if any?  (Most of the time probably the CVEs don't apply.)

Bureaucrats sometimes forward e-mails about CVE numbers and want us to
assure them that we're "safe" and entering CVE numbers in My Oracle Support
doesn't usually turn up anything.

I am guessing that for DBAs in more secure environments this is routine
stuff, thought maybe someone might be able to provide some pointers.

I know about the typical advice like "stay up-to-date with your software
versions" -- except for that OpenSSL bug LOL which got some people in
trouble, no memory sticks or used to be CDs (esp. if people are outside
your building handing them out for free), passwords are not all that secure
(some employees are willing to give them up for a little gift at the door),
social engineering, don't trust your own employees, etc. etc.   I am just
looking for a lookup site somewhere that we might be able to trust.

-- Patrice
My profiles: [image: Facebook]
<http://www.facebook.com/home.php?#!/profile.php?id=100000206805521>[image:
LinkedIn] <http://ca.linkedin.com/pub/patrice-boivin/a/933/5a9>[image:
Twitter] <http://www.twitter.com/PatriceBoivin>
 <http://www.twitter.com/PatriceBoivin>
Signature powered by WiseStamp <http://www.wisestamp.com/email-install>

--001a11c3c8c4d2111e04fb2d90da
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>I was wondering, does Oracle have a CVE equivalency d=
atabase that would let us enter a CVE and find out if it applies to any Ora=
cle products and what versions, if any?=C2=A0 (Most of the time probably th=
e CVEs don&#39;t apply.)<br>

<br></div>Bureaucrats sometimes forward e-mails about CVE numbers and want =
us to assure them that we&#39;re &quot;safe&quot; and entering CVE numbers =
in My Oracle Support doesn&#39;t usually turn up anything.<br clear=3D"all"=
>

<div><div><div><br></div><div>I am guessing that for DBAs in more secure en=
vironments this is routine stuff, thought maybe someone might be able to pr=
ovide some pointers.<br><br></div><div>I know about the typical advice like=
 &quot;stay up-to-date with your software versions&quot; -- except for that=
 OpenSSL bug LOL which got some people in trouble, no memory sticks or used=
 to be CDs (esp. if people are outside your building handing them out for f=
ree), passwords are not all that secure (some employees are willing to give=
 them up for a little gift at the door), social engineering, don&#39;t trus=
t your own employees, etc. etc.=C2=A0=C2=A0 I am just looking for a lookup =
site somewhere that we might be able to trust.<br>

<br></div><div><div><span style=3D"font-size:13.3px;font-family:Verdana,Ari=
al,Helvetica,sans-serif"><p style=3D"margin:0 0 8px 0">-- Patrice</p><span =
style=3D"color:gray">My profiles: </span> <a href=3D"http://www.facebook.co=
m/home.php?#!/profile.php?id=3D100000206805521" style=3D"text-decoration:un=
derline" target=3D"_blank"><img alt=3D"Facebook" style=3D"padding:0px 3px 5=
px 0px;vertical-align:middle" src=3D"http://images.wisestamp.com/facebook.p=
ng" border=3D"0"></a><a href=3D"http://ca.linkedin.com/pub/patrice-boivin/a=
/933/5a9" style=3D"text-decoration:underline" target=3D"_blank"><img alt=3D=
"LinkedIn" style=3D"padding:0px 3px 5px 0px;vertical-align:middle" src=3D"h=
ttp://images.wisestamp.com/linkedin.png" border=3D"0"></a><a href=3D"http:/=
/www.twitter.com/PatriceBoivin" style=3D"text-decoration:underline" target=
=3D"_blank"><img alt=3D"Twitter" style=3D"padding:0px 3px 5px 0px;vertical-=
align:middle" src=3D"http://images.wisestamp.com/twitter.png" border=3D"0">=
</a></span></div>

<div><span style=3D"font-size:13.3px;font-family:Verdana,Arial,Helvetica,sa=
ns-serif"><a href=3D"http://www.twitter.com/PatriceBoivin" style=3D"text-de=
coration:underline" target=3D"_blank"></a><br><div style=3D"border-top:1px =
solid #eeeeee;margin-top:12px;padding-top:2px;color:#aaa;font-size:70%">

Signature powered by <a style=3D"color:#555;text-decoration:none" href=3D"h=
ttp://www.wisestamp.com/email-install" target=3D"_blank"><span style=3D"col=
or:#444">WiseStamp</span></a>=C2=A0</div></span></div>
</div></div></div></div>

--001a11c3c8c4d2111e04fb2d90da--
--
http://www.freelists.org/webpage/oracle-l