Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Oracle Users Struggle With Patch Management

Despite new tools that speed deployment, many administrators are still far behind

Oracle issued 41 security patches for its products in January, and another 43 in April. As the database giant prepares another round of quarterly patches, here's a question: How many of these patches has your organization deployed this year?

If you answered "none," you're not alone. According to a study published in February by the Independent Oracle Users Group (IOUG), nearly half of all Oracle users are at least two or more patch cycles -- that's six to nine months -- behind in their database patching. Eight percent are four or more cycles (more than a year) behind, and 11 percent have never applied one of Oracle's Critical Patch Updates.

An informal study of Oracle users published earlier this year by Sentrigo, which offers a virtual patch management tool for Oracle environments, offered even more stark results. In a rolling poll that totaled 305 respondents, Sentrigo found that only 10 percent of Oracle users had installed the most recent Oracle patch update. More than two-thirds said they had never applied an Oracle patch update.

While some experts dispute the findings of these studies, most agree that many database administrators are slow to roll out new patches. Why? Many of them are concerned that the patches might slow performance or cause disconnects between business applications and the databases that serve them.

"The requirement for extensively testing patches across complex and large production environments [is] a primary difficulty [in] timely application of Critical Patch Updates," the IOUG study says. "While the application of the patches may take a few hours, the actual testing of the patches before their application in production systems may take months in some organizations."

Shortly after the IOUG presented its study findings to Oracle management, Oracle announced it would look for ways to further educate customers about the importance of security patching. One such effort took place last month, when Eric Maurice, director of Oracle's Software Security Assurance program, presented a webinar abouot simplifying the patch process.

In the webinar, Maurice offered a detailed look at My Oracle Support, a customized system that users can access to perform a "health check" on their applications. The system leverages data from the Oracle Configuration Manager agent software -- sometimes called the Oracle Collector -- which pulls data from Oracle implementations and alerts users to potential problems or vulnerabilities.

The Collector provides Oracle users with an overview of their Oracle home environments, including which patches have been installed, which platforms the user has deployed, and a summary of the content in their Oracle configuration files, Maurice explains. Once the data has been collected, the system also helps users to locate the missing patches and deploy them immediately, he says.

"The Collector is embedded in many of our products, but it needs to be enabled in your environment before it can work," Maurice observes. If the user does not enable the Collector, then the user will not be automatically notified of patches that might be missing from their applications, he states. The Collector can be enabled across multiple instances of Oracle databases or applications and managed centrally, so it can be used to monitor patches in large environments, Maurice says.

Yet while Maurice's presentation offers some simple steps toward identifying missing patches and deploying them swiftly, he did not address the issue of long testing periods that may delay users from patch deployment -- or the potential impact of new patches on database performance. The IOUG report says the company "will be looking at ways to bring further enhancements to the Critical Patch Update documentation in order to help customers determine which areas need to be tested in their environment prior to the deployment of Critical Patch Updates against production systems."

"The results of this survey seem to indicate that it is typical for Oracle systems and database administrators to be required to justify the deployment of security patches," the IOUG report says. "From a security perspective, it seems more appropriate that organizational policies require that the non-deployment of security patches be justified."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This gives a new meaning to blind leading the blind.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3595
PUBLISHED: 2021-06-15
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or in...
CVE-2021-3592
PUBLISHED: 2021-06-15
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 byt...
CVE-2021-3593
PUBLISHED: 2021-06-15
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or in...
CVE-2021-3594
PUBLISHED: 2021-06-15
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or ind...
CVE-2021-33622
PUBLISHED: 2021-06-15
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value.