Oracle Patches Get Bad Rap

On the surface, a recently published survey by the Independent Oracle Users Group (IOUG) bears some seemingly frightening numbers. According to the study, which was conducted during the middle of 2008, 26 percent of 150 respondents admitted that their respective companies require the quarterly Oracle patches to be applied upon release. Nineteen percent said their companies don't have any policies at all regarding patches. Only 42 percent believed the patches from Oracle were effective in helping them keep a positive security posture.Why do Oracle customers disregard the seriousness of the vendor patches? Do they not have strong CSOs who understand the risks associated with not patching? Or is it that they feel protected already? If nearly half think the Oracle updates are positive toward their security postures, what is the other half doing that makes them feel secure already?

As a security professional, I find it hard to believe the questionnaire's respondents are responsible for truly mission-critical systems that, if hacked, could cause the organization's demise. On the other hand, I know that Oracle systems don't simply sit exposed on the Internet, though, sadly, exceptions probably exist. They'll be contained inside the corporate perimeter within the datacenter, and quite possibly within an even more tightly controlled network segment within the datacenter.

So, what's the significance of these numbers? Not much. That's because the survey doesn't provide any context as to why the companies are not patching. The IOUG's president said it's likely that admins don't patch their systems because they're more isolated, as I said above, but I'm still left wondering what the numbers really mean without having more questions answered, such as: Did the companies perform comprehensive risk assessments to determine whether to deploy Oracle patches?

What I do want to point out for you infosec pros and pen testers is a great resource on hacking Oracle servers. During the past few months, Chris Gates has put on his blog, Carnal0wnage, some awesome examples of using the Metasploit Framework's Oracle modules. If you have Oracle servers in your environment or perform pen testing for companies that use Oracle, take the time to walk through the examples and test out the modules. You never know when they might come in handy.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.