Re: Which is more secure? Oracle vs. Microsoft

["Alexander Kornbrust" <ak () red-database-security com>]

Hi David,

I agree with your posting that the overall security of Microsoft SQL Server
comparing to an Oracle database is (much) higher. I also agree that
Microsoft SDL is a real benefit for SQL Server. 

Last year Cesar Cerrudo gave already a presentation about the topic: MSSQL
vs. Oracle
(http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-cerrudo.pdf)


But you are comparing apples and oranges. Oracle is a much more complex
product and has a lot more features than SQL Server. It's a little bit like
comparing an Airbus with a Cesna. Both are airplanes...

Oracle 10g Rel. 2 for example has 17,261 PL/SQL- functions and procedures
(select count(*) from all_procedures, default installation with samples). 
 

Here are some smaller corrections concerning your paper comparision.pdf: 

The following bugs are Oracle application server bugs (Oracle Portal 9.0.2)
and 
not RDBMS bugs. Oracle looks a little bit better now (- 6 security bugs)...

        wwv_form.genpopuplist SQL Inj., Alert 61, CVE-2003-1193          
        wwv_ui_lovf.show SQL Inj., Alert 61, CVE-2003-1193       
        ORG_CHART.SHOW SQL Inj., Alert 61, CVE-2003-1193         
        wwa_app_module.link SQL Inj., Alert 61, CVE-2003-1193    
        wwv_dynxml_generator.show, Alert 61,CVE-2003-1193        

The SOAP bug (Alert 65) is not a RDBMS bug
    (see
http://www.oracle.com/technology/deploy/security/pdf/2004alert65.pdf)



Regards

 Alexander Kornbrust
 
 --
 Red-Database-Security GmbH
 http://www.red-database-security.com
  

> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 21 Nov 2006 04:29:48 -0000
> From: "David Litchfield" <davidl () ngssoftware com>
> Subject: [Full-disclosure] Which is more secure? Oracle vs. Microsoft
> To: <full-disclosure () lists grok org uk>
> Message-ID: <024101c70d25$ae07db50$4001a8c0 () ngssoftware com>
> Content-Type: text/plain; format=flowed; charset="iso-8859-1";
>       reply-type=original
>
> Hey all,
> What started out as a fun project for me turned out some 
> serious results - "Which is more secure? Oracle vs Microsoft" 
> is a paper I put together looking at the number of security 
> flaws in the Oracle and MS database offerings. For those that 
> are interested, you can grab a copy of the results
> here: http://www.databasesecurity. com/dbsec/comparison.pdf
> Cheers,
> David 
>
>
>
> ------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/