Re: Which is more secure? Oracle vs. Microsoft

["David Litchfield" <davidl () ngssoftware com>]

> Interesting paper. I do have a couple of points though:
> a. Your graphs show the number of risks found, however, it would be
> interesting to note the comparison in the severity of risks found. So
> I did a quick count on issues =~ (overflow) (format string):
> Microsoft SQL Count 39
> Oracle Count 19

The vast majority of the Oracle flaws are SQL Injection allowing a low 
privileged user to gain DBA privs. Further - your count of 19 doesn't 
include the Oracle overflows fixed in the CPUs - I don't break those bugs 
out into details because the CPUs do that themselves.


> b. You also mention SDL being the reason as to why Microsoft have had
> so few issues. It seems to good to be true that SDL would really solve
> all these problems, then again maybe it has. Looking at my comments
> above (see a.), could I not suggest that some of these issues are not
> re-occuring due to stack protection being implemented in XP2 and
> Windows 2003?

You can suggest of course :) but it's not the case. It has nothing to do 
with stack protection - it's deafeatable in many situations - even if it's 
not apparently immediately exploitable MS will fix it as if it is.
Cheers,
David


> Kind regards,
> David Kierznowski

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/