You think it is a patch, but actually ......

BKJIA May 8 Internet headlines] generally, as long as a software company releases patches for its own products, we should actively deploy them as they are of great significance for fixing vulnerabilities. However, sometimes the patch is not a real patch, but the configuration is changed.

Take the patch that Oracle released earlier last week as an example. According to Qualys security product companies, this patch is designed for numbering CVE-201-1675 problems, the zero-day vulnerability named "TNS Poison" was fixed, allowing attackers to launch man-in-the-middle attacks by registering additional database instances in the TNS listener. As Wolfgang Kandek said in his blog:

This vulnerability exists in the TNS listener of the Oracle database server, allowing attackers to launch man-in-the-middle attacks by registering additional database instances in the TNS listener. The listener starts the traffic load balancing function for this new instance. Attackers can obtain and record database information and finally forward it to the original database. In short, attackers have the opportunity to tamper with the information on the original database server and execute commands.

The problem is that Oracle only released a configuration change for this vulnerability, but did not develop a real patch. Ericka chickoski of the Dark Reading website pointed out that this is only one of the examples of Oracle's series of customer service accidents. At present, its database applications have almost become synonymous with vulnerabilities and defects. In an interview with Josh Shaul, the Security expert from the TeammSHATTER team of Application Security company expressed the following points:

We are all unknowingly dependent on these systems in our daily lives. from ATMs to parking toll stations in office buildings, they are almost ubiquitous. However, in fact, these systems have many vulnerabilities and some have never been fixed over the years, which is indeed disturbing-but it is not too late to try to solve the problem actively from now on. If you are responsible for database security or other systems that contain large amounts of sensitive data, be sure to be vigilant, attackers can use these oldest vulnerabilities to crack down on our information.

Why is Oracle doing so poorly in providing timely and effective patches for its own databases and other applications, disappointing countless security experts? Shaul believes that customers should try to convey their voice to software developers. Such demand for perfect services will greatly promote the developers' enthusiasm for fixing products:

Enterprises that spend millions of dollars on database software undoubtedly have a strong say. Whether it's security risk transparency or security Defect Assessment Reports, Oracle has to do its best to satisfy such customers as long as they want. Before that, however, Oracle software vendors could only provide regular fixes on time, and they had the sole say of what problems were imminent and what risks and dangers were even greater.

Can this routine fix meet your needs? Now, it's time to give the swordsmanistic enterprises a bit of color. TeamSHATTER evaluated Oracle's inaction as follows:

Original article: A Patch Is Not Always a Patch