, SecurityFocus 2002-01-16
A U.K. security expert is preparing to unveil a trove of serious vulnerabilities in Oracle's database products. Can the company redefine 'unbreakable' in time?
“
When they say their software is unbreakable, they're lying.
”
That simple bold message of invulnerability has grown into something of an IT cultural touchstone since Oracle CEO Larry Ellison unveiled the campaign at Comdex last November. The "unbreakable" claim is writ large on billboards, sent out in email ads, printed in the glossy pages of magazines, and displayed on Web banners. Type "unbreakable" into Google and a sponsored link to Oracle is likely to pop up on top. The campaign seems to touch a chord, implicitly promising safety from unseen attackers, and certainty in an uncertain time.
If the marketing message suffers from one flaw, it is this: It isn't exactly true. In December, U.K. security researcher David Litchfield revealed that a common programming error -- a buffer overflow -- was present in Oracle's application server, potentially allowing hackers to gain remote access to the system over the Internet. PenTest Limited and eEye Digital Security followed up with advisories of their own on less severe holes.
"If to them 'unbreakable' doesn't even mean they eliminate buffer overflows, how can it possibly mean they've secured the hard stuff?," says Bruce Schneier, founder and CTO of Counterpane Internet Security. "Fixing buffer overflows is the price of admission."
Making matters worse for Oracle, it turns out that those holes were little more than a prelude to a suite of at least seven vulnerabilities currently in the company's patch pipeline -- all of them discovered by Litchfield last fall. Assuming fixes are available in time, Litchfield plans to present the holes at a security conference in early February, including details of serious bugs that allow attackers to both "break it" and "break in."
"They range from buffer overflows, to something in the way Oracle communicates with different components," says Litchfield, lead designer and developer at
While Oracle's vulnerabilities are no greater in number or severity than those found in other major software products, some experts charge that the steady stream of security holes transforms "unbreakable" from a harmless marketing gimmick into a potentially dangerous misstatement.
"The more people out there saying they have an unbreakable product, it gives customers a false sense of security," says David Dittrich, senior security engineer at the University of Washington. "I'd rather they boast about having a good programming team, or a good auditing process."
"We all know it's breakable," says Tim Mullen, CIO of AnchorIS.Com, and a columnist for SecurityFocus. Mullen broke the news of the latest batch of Oracle holes in a recent
But Oracle chief security officer Mary Ann Davidson says the criticism is unfair. In an emailed response to Mullen's commentary, Davidson wrote that Oracle is giving the holes reported by Litchfield the "highest priority," but suggested that everything depends on what your definition of "unbreakable" is.
Rather than representing a literal claim that Oracle's products are impregnable, the campaign "speaks to" fourteen independent security evaluations that Oracle's database server passed, Davidson wrote, and "represents Oracle's commitment to a secure product lifecycle for our entire product suite."
"We believe the market effect of the 'Unbreakable' campaign raises the security bar and therefore improves security overall, both in forcing us to live up to the statement, and forcing others in the industry to begin to do the same," wrote Davidson. "If our security today is imperfect but better than the competition, and if customers make a buying decision based on that criteria, than in the long term you will see all products in the market improve."
A company spokesperson declined to discuss any particular security holes, or how they can be reconciled with Oracle's "Unbreakable" and "Can't break in" claims. But in a written statement, the company emphasized that Oracle responds quickly to close newly-discovered vulnerabilities -- an assessment with which Litchfield agrees.
"The Oracle database server itself runs on some sixty odd different operating systems," says Litchfield. "They have to test each different operating system. A couple of months is a speedy response."
Litchfield discovered the slew of vulnerabilities while developing NGSSoftware's Oracle security scanner, planned for release next month. He issued an advisory on one of the holes in December, after Oracle made a fix available. Details on the other, more serious holes remain a closely held secret pending more patches, which Litchfield hopes to see the company deliver in time for a presentation he has planned for the Black Hat Windows Security
He says he's not aware of any of the holes being actively exploited by hackers, but offers that one of the more serious vulnerabilities has been in every revision of Oracle's database server since at least Oracle 8, which was released in 1999. "When this information goes public, you'll go, 'Oh my God, that's so obvious, why didn't anybody think of that before?,'" says Litchfield.
Litchfield says he isn't bothered by Oracle's "Unbreakable" claim -- he's satisfied with Davidson's explanation that the campaign is really just meant to underscore the software's lineup of security certifications. But Schneier, and other experts, say that security is too serious to be made the stuff of exaggerated marketing claims.
"I don't like it when marketing jargon takes over reality," says Schneier. "The word 'unbreakable' has a meaning, in English. When they say their software is unbreakable, they're lying."
