full-disclosure - Re: Which is more secure? Oracle vs. Microsoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <001001c70d7e$aa8546d0$1b02a8c0@rds.local>
Date: Tue, 21 Nov 2006 16:06:46 +0100
From: "Alexander Kornbrust" <ak@...-database-security.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: Which is more secure? Oracle vs. Microsoft

Hi David,

I agree with your posting that the overall security of Microsoft SQL Server
comparing to an Oracle database is (much) higher. I also agree that
Microsoft SDL is a real benefit for SQL Server. 

Last year Cesar Cerrudo gave already a presentation about the topic: MSSQL
vs. Oracle
(http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-cerrudo.pdf)

But you are comparing apples and oranges. Oracle is a much more complex
product and has a lot more features than SQL Server. It's a little bit like
comparing an Airbus with a Cesna. Both are airplanes...

Oracle 10g Rel. 2 for example has 17,261 PL/SQL- functions and procedures
(select count(*) from all_procedures, default installation with samples). 

Here are some smaller corrections concerning your paper comparision.pdf: 

The following bugs are Oracle application server bugs (Oracle Portal 9.0.2)
and 
not RDBMS bugs. Oracle looks a little bit better now (- 6 security bugs)...

	wwv_form.genpopuplist SQL Inj., Alert 61, CVE-2003-1193 	 
	wwv_ui_lovf.show SQL Inj., Alert 61, CVE-2003-1193 	 
	ORG_CHART.SHOW SQL Inj., Alert 61, CVE-2003-1193 	 
	wwa_app_module.link SQL Inj., Alert 61, CVE-2003-1193 	 
	wwv_dynxml_generator.show, Alert 61,CVE-2003-1193 	 

The SOAP bug (Alert 65) is not a RDBMS bug
    (see
http://www.oracle.com/technology/deploy/security/pdf/2004alert65.pdf)

Regards

 Alexander Kornbrust

 --
 Red-Database-Security GmbH
 http://www.red-database-security.com

> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Tue, 21 Nov 2006 04:29:48 -0000
> From: "David Litchfield" <davidl@...software.com>
> Subject: [Full-disclosure] Which is more secure? Oracle vs. Microsoft
> To: <full-disclosure@...ts.grok.org.uk>
> Message-ID: <024101c70d25$ae07db50$4001a8c0@...software.com>
> Content-Type: text/plain; format=flowed; charset="iso-8859-1";
> 	reply-type=original
> 
> Hey all,
> What started out as a fun project for me turned out some 
> serious results - "Which is more secure? Oracle vs Microsoft" 
> is a paper I put together looking at the number of security 
> flaws in the Oracle and MS database offerings. For those that 
> are interested, you can grab a copy of the results
> here: http://www.databasesecurity. com/dbsec/comparison.pdf
> Cheers,
> David 
> 
> 
> 
> ------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/