Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Oracle Users Struggle With Patch Management

Despite new tools that speed deployment, many administrators are still far behind

Oracle issued 41 security patches for its products in January, and another 43 in April. As the database giant prepares another round of quarterly patches, here's a question: How many of these patches has your organization deployed this year?

If you answered "none," you're not alone. According to a study published in February by the Independent Oracle Users Group (IOUG), nearly half of all Oracle users are at least two or more patch cycles -- that's six to nine months -- behind in their database patching. Eight percent are four or more cycles (more than a year) behind, and 11 percent have never applied one of Oracle's Critical Patch Updates.

An informal study of Oracle users published earlier this year by Sentrigo, which offers a virtual patch management tool for Oracle environments, offered even more stark results. In a rolling poll that totaled 305 respondents, Sentrigo found that only 10 percent of Oracle users had installed the most recent Oracle patch update. More than two-thirds said they had never applied an Oracle patch update.

While some experts dispute the findings of these studies, most agree that many database administrators are slow to roll out new patches. Why? Many of them are concerned that the patches might slow performance or cause disconnects between business applications and the databases that serve them.

"The requirement for extensively testing patches across complex and large production environments [is] a primary difficulty [in] timely application of Critical Patch Updates," the IOUG study says. "While the application of the patches may take a few hours, the actual testing of the patches before their application in production systems may take months in some organizations."

Shortly after the IOUG presented its study findings to Oracle management, Oracle announced it would look for ways to further educate customers about the importance of security patching. One such effort took place last month, when Eric Maurice, director of Oracle's Software Security Assurance program, presented a webinar abouot simplifying the patch process.

In the webinar, Maurice offered a detailed look at My Oracle Support, a customized system that users can access to perform a "health check" on their applications. The system leverages data from the Oracle Configuration Manager agent software -- sometimes called the Oracle Collector -- which pulls data from Oracle implementations and alerts users to potential problems or vulnerabilities.

The Collector provides Oracle users with an overview of their Oracle home environments, including which patches have been installed, which platforms the user has deployed, and a summary of the content in their Oracle configuration files, Maurice explains. Once the data has been collected, the system also helps users to locate the missing patches and deploy them immediately, he says.

"The Collector is embedded in many of our products, but it needs to be enabled in your environment before it can work," Maurice observes. If the user does not enable the Collector, then the user will not be automatically notified of patches that might be missing from their applications, he states. The Collector can be enabled across multiple instances of Oracle databases or applications and managed centrally, so it can be used to monitor patches in large environments, Maurice says.

Yet while Maurice's presentation offers some simple steps toward identifying missing patches and deploying them swiftly, he did not address the issue of long testing periods that may delay users from patch deployment -- or the potential impact of new patches on database performance. The IOUG report says the company "will be looking at ways to bring further enhancements to the Critical Patch Update documentation in order to help customers determine which areas need to be tested in their environment prior to the deployment of Critical Patch Updates against production systems."

"The results of this survey seem to indicate that it is typical for Oracle systems and database administrators to be required to justify the deployment of security patches," the IOUG report says. "From a security perspective, it seems more appropriate that organizational policies require that the non-deployment of security patches be justified."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Out-of-Date and Unsupported Cloud Workloads Continue as a Common Weakness
Robert Lemos, Contributing Writer,  7/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16271
PUBLISHED: 2020-08-03
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection.
CVE-2020-16272
PUBLISHED: 2020-08-03
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection.
CVE-2020-8574
PUBLISHED: 2020-08-03
Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service enabled allowing unauthorized code execution to local users.
CVE-2020-8575
PUBLISHED: 2020-08-03
Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service (DoS).
CVE-2020-12739
PUBLISHED: 2020-08-03
A vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause an affected CNC to become inaccessible to other devices. The vulnerability is due to improper design or implementation of the Ethernet communication modules of the CNC. An attack...