"Microsoft admits Patriot Act can access EU-based cloud data" was the headline in a recent ZDNet article.
"Any data which is housed, stored or processed by a company, which is a U.S. based company or is wholly owned by a U.S. parent company, is vulnerable to interception and inspection by U.S. authorities."
This goes a bit beyond the standard hosting security concerns and would certainly curb my enthusiasm for cloud-based hosting or any hosting for that matter.
Somebody set up us the bomb.*
* http://knowyourmeme.com/memes/all-your-base-are-belong-to-us
Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
Monday, July 4, 2011
Wednesday, April 27, 2011
EnterpriseOne Security Vulnerability
Usually when Oracle sends out their quarterly Critical Patch Update Advisory they are chock full of vulnerabilities for Oracle database and Solaris or Java but nothing for EnterpriseOne. This time however...
Oracle has reported that a security vulnerability exists for EnterpriseOne.
The starting point for the security notice is here: http://www.oracle.com/technetwork/topics/security/alerts-086861.html but I have to caution that you will click no less than five links to finally get to the document that reveals....absolutely nothing about the vulnerability. The PDF is here: https://support.oracle.com/CSP/main/article?cmd=show&type=ATT&id=1315038.1:04201101 and lists eight Security Vulnerability ID's all of which state:
"Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Enterprise Infrastructure SEC). Supported versions that are affected are 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some JD EdwardsEnterpriseOne Tools accessible data as well as read access to a subset of JD Edwards EnterpriseOne Tools accessible data and ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools."
Repeated efforts through GSS to determine the exact reason for the security issue did not yield the root cause. They simply will not tell you. Since the suggested remedy (update Tools Release level) is non-trivial we think it is important for Oracle to clarify the rather vague description to give customers better information on which to base their cost-benefit analysis for a Tools update.
I don't think Oracle quite understands that applying a "patch" for E1 is not quite as simple as applying a patch for Solaris or Oracle dB.
Subscribe to The Karamazov Group Blog - Get an email when new posts appear
Oracle has reported that a security vulnerability exists for EnterpriseOne.
The starting point for the security notice is here: http://www.oracle.com/technetwork/topics/security/alerts-086861.html but I have to caution that you will click no less than five links to finally get to the document that reveals....absolutely nothing about the vulnerability. The PDF is here: https://support.oracle.com/CSP/main/article?cmd=show&type=ATT&id=1315038.1:04201101 and lists eight Security Vulnerability ID's all of which state:
"Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Enterprise Infrastructure SEC). Supported versions that are affected are 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3. Difficult to exploit vulnerability allows successful unauthenticated network attacks via TCP/IP. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some JD EdwardsEnterpriseOne Tools accessible data as well as read access to a subset of JD Edwards EnterpriseOne Tools accessible data and ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools."
Repeated efforts through GSS to determine the exact reason for the security issue did not yield the root cause. They simply will not tell you. Since the suggested remedy (update Tools Release level) is non-trivial we think it is important for Oracle to clarify the rather vague description to give customers better information on which to base their cost-benefit analysis for a Tools update.
I don't think Oracle quite understands that applying a "patch" for E1 is not quite as simple as applying a patch for Solaris or Oracle dB.
Thursday, October 14, 2010
Oracle Critical Patch Update - October 2010
JD Edwards EnterpriseOne: No items included in the October 2010 CPU
That's very nice to read, very nice indeed. The question is this: Why are there no patches? Is it because the user base for E1 is so small as to not attract attacks? Is our software that secure? Is it because we are not actively searching for exposures? Is it because we report them but they don't get passed on to Oracle's security team?
Feel free to discuss in the comments.
By the way, to subscribe to Oracle's Critical Patch Update Emails go here: http://www.oracle.com/technetwork/topics/security/securityemail-090378.html.
Subscribe to The Karamazov Group Blog - Get an email when new posts appear
That's very nice to read, very nice indeed. The question is this: Why are there no patches? Is it because the user base for E1 is so small as to not attract attacks? Is our software that secure? Is it because we are not actively searching for exposures? Is it because we report them but they don't get passed on to Oracle's security team?
Feel free to discuss in the comments.
By the way, to subscribe to Oracle's Critical Patch Update Emails go here: http://www.oracle.com/technetwork/topics/security/securityemail-090378.html.
Subscribe to:
Posts (Atom)
Email
Twitter
RSS