Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Oracle Users Struggle With Patch Management

Despite new tools that speed deployment, many administrators are still far behind

Oracle issued 41 security patches for its products in January, and another 43 in April. As the database giant prepares another round of quarterly patches, here's a question: How many of these patches has your organization deployed this year?

If you answered "none," you're not alone. According to a study published in February by the Independent Oracle Users Group (IOUG), nearly half of all Oracle users are at least two or more patch cycles -- that's six to nine months -- behind in their database patching. Eight percent are four or more cycles (more than a year) behind, and 11 percent have never applied one of Oracle's Critical Patch Updates.

An informal study of Oracle users published earlier this year by Sentrigo, which offers a virtual patch management tool for Oracle environments, offered even more stark results. In a rolling poll that totaled 305 respondents, Sentrigo found that only 10 percent of Oracle users had installed the most recent Oracle patch update. More than two-thirds said they had never applied an Oracle patch update.

While some experts dispute the findings of these studies, most agree that many database administrators are slow to roll out new patches. Why? Many of them are concerned that the patches might slow performance or cause disconnects between business applications and the databases that serve them.

"The requirement for extensively testing patches across complex and large production environments [is] a primary difficulty [in] timely application of Critical Patch Updates," the IOUG study says. "While the application of the patches may take a few hours, the actual testing of the patches before their application in production systems may take months in some organizations."

Shortly after the IOUG presented its study findings to Oracle management, Oracle announced it would look for ways to further educate customers about the importance of security patching. One such effort took place last month, when Eric Maurice, director of Oracle's Software Security Assurance program, presented a webinar abouot simplifying the patch process.

In the webinar, Maurice offered a detailed look at My Oracle Support, a customized system that users can access to perform a "health check" on their applications. The system leverages data from the Oracle Configuration Manager agent software -- sometimes called the Oracle Collector -- which pulls data from Oracle implementations and alerts users to potential problems or vulnerabilities.

The Collector provides Oracle users with an overview of their Oracle home environments, including which patches have been installed, which platforms the user has deployed, and a summary of the content in their Oracle configuration files, Maurice explains. Once the data has been collected, the system also helps users to locate the missing patches and deploy them immediately, he says.

"The Collector is embedded in many of our products, but it needs to be enabled in your environment before it can work," Maurice observes. If the user does not enable the Collector, then the user will not be automatically notified of patches that might be missing from their applications, he states. The Collector can be enabled across multiple instances of Oracle databases or applications and managed centrally, so it can be used to monitor patches in large environments, Maurice says.

Yet while Maurice's presentation offers some simple steps toward identifying missing patches and deploying them swiftly, he did not address the issue of long testing periods that may delay users from patch deployment -- or the potential impact of new patches on database performance. The IOUG report says the company "will be looking at ways to bring further enhancements to the Critical Patch Update documentation in order to help customers determine which areas need to be tested in their environment prior to the deployment of Critical Patch Updates against production systems."

"The results of this survey seem to indicate that it is typical for Oracle systems and database administrators to be required to justify the deployment of security patches," the IOUG report says. "From a security perspective, it seems more appropriate that organizational policies require that the non-deployment of security patches be justified."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...
PUBLISHED: 2021-06-14
Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the...