full-disclosure - Re: Which is more secure? Oracle vs. Microsoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 21 Nov 2006 16:52:29 -0000
From: "David Litchfield" <davidl@...software.com>
To: "David Kierznowski" <david.kierznowski@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Which is more secure? Oracle vs. Microsoft

> Interesting paper. I do have a couple of points though:
> a. Your graphs show the number of risks found, however, it would be
> interesting to note the comparison in the severity of risks found. So
> I did a quick count on issues =~ (overflow) (format string):
> Microsoft SQL Count 39
> Oracle Count 19

The vast majority of the Oracle flaws are SQL Injection allowing a low 
privileged user to gain DBA privs. Further - your count of 19 doesn't 
include the Oracle overflows fixed in the CPUs - I don't break those bugs 
out into details because the CPUs do that themselves.

>
> b. You also mention SDL being the reason as to why Microsoft have had
> so few issues. It seems to good to be true that SDL would really solve
> all these problems, then again maybe it has. Looking at my comments
> above (see a.), could I not suggest that some of these issues are not
> re-occuring due to stack protection being implemented in XP2 and
> Windows 2003?

You can suggest of course :) but it's not the case. It has nothing to do 
with stack protection - it's deafeatable in many situations - even if it's 
not apparently immediately exploitable MS will fix it as if it is.
Cheers,
David

>
> Kind regards,
> David Kierznowski
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/