Oracle reprimanded over lack of patches

Red Database Security, who specialise in Oracle security, said it informed Oracle of the vulnerabilities, some as far back as two years ago. But when a critical patch update was released this month, it failed to include fixes to these flaws.

"It seems Oracle is not interested or not able to fix these security bugs," said Alexander Kornbrust, security researcher at Red Database Security.

The vulnerabilities affect Oracle Forms and Oracle Reports, which could be exploited by attackers to carry out random commands or leak confidential information.

Red Database claimed it warned Oracle it would publish details of the flaws after growing tired of waiting for solutions. But Oracle issued a statement saying that its policy is to fix vulnerabilities in order of their severity.

www.red-database-security.com