Sven’s Technik-Blog

In the current Oracle Critical Patch Update (April 2009) all our Security Bugs are solved, as well in Oracle Database version 11.1.0.7.

Starting from now, I can recommend Database Vault.

But please read the documentation carefully. Database Vault does not help for all security requirements (e.g. encryption).

Learn more about Database Vault - and which options you need for a secure environment - in our new TechnoCircle Compliance...

Nächste Woche (21.+22.10.) finden die ersten Schweizer Datenbanktage statt - die TrivadisOPEN.

Ich denke, dies ist eine Veranstaltung, die jeden Datenbankprofi interessieren sollte - egal ob Oracle oder Microsoft, egal ob DBA, Entwickler oder Security-Experte.

Ein paar Highlights (für mich natürlich aus dem Oracle-Bereich ):

• Carry Millsap: "Millsap's Grand Unified Theory of 'Tuning'"
• Christian Antognini: "Query Optimizer 11g"
• Anton Topurov (CERN Genf): "CERN experience with virtualization of Oracle RAC with native XEN and Oracle VM"
• Roger Wullschleger (Oracle): "Oracle Enterprise Manager Data Masking Pack"

Auch die Keynote-Speaker sind sehr zu empfehlen - und natürlich auch der Überraschungsgast

Mehr Informationen findet ihr hier - und hier die Agenda.

Ich würde mich freuen, ein paar bekannte (und auch unbekannte) Gesichter zu sehen...

First chapter in the Patch Set Notes:

...
Patch sets provide bug fixes only; they do not include new functionality and they do not require certification on the target system.
...

This is so not true

There is at least one new feature: a new package called DBMS_AUDIT_MGMT.

This should be mainly used with Oracle Audit Vault. But they are some interesting procedures and functions for "normal" auditing too:

• defining of file size and aging from os audit files
• automatic purging from audit records
• moving from audit tables in another tablespace (yes - official supported )
• ...

Happy auditing...

The first patchset for Oracle Database 11g is available.

File size (Linux 32 bit): 1.5 GB!!! Happy download

For quite some time I have been trying to persuade my colleagues to write a MySQL plug-in for Oracle Grid Control. Without success...

But now an official plug-in is available, created by Alex Gorbachev (Pythian Group). It can be downloaded from the "Oracle Enterprise Manager 10g Grid Control
Extensions Exchange" page too - and it is tested from Oracle

There are very interesting tables and charts included, for instance:

For more information: see the datasheet.

A new Audit Vault version is ready for download (for Linux, Solaris, AIX and HP Itanium) . Maybe some bugs are fixed...
I will test it

During the last days we have tested the CPU very intensively.

Some information about it:

• I recommend applying it, if you use Oracle Application Express (APEX) 3.0. Because on iDefense it is described, how easy a security hole can vulnerable.
  You can upgrade to APEX 3.1 too.
• This is the first CPU without need for a newer version of OPatch (if you applied the patchset before). This means applying would be easier and the software would be more stable

After the x86-Linux and the 32-bit Windows version now the x84-64bit Linux version is ready for download.

For more information see here.

Here is the first information about the next CPU.

Database:

• This CPU contains 17 new security fixes (including 2 for Oracle Application Express)
• The highest CVSS base score of vulnerabilities is 6.6.
  This is regarded as a high risk.
• Some very critical components are affected:
  • Audit
  • Authentication
  • Core RDBMS
  • Data Pump
  • Export
  • Oracle Net Services
  • Query Optimizer
  • ...
• This CPU includes fixes for Oracle Database 11g too.

Oracle Application Server:

• This CPU contains 3 new security fixes
• All of these vulnerabilities may be remotely exploited without authentication!
• The highest CVSS base score of vulnerabilities is 9.3 for clients and 6.6 for servers.
  This is regarded as a very high risk.

Oracle Enterprise Manager:

• This CPU contains 1 new security fix (in the Oracle Agent)
• The CVSS base score of vulnerability is 6.6.
  This is regarded as a high risk.

Until now I have written every article in German. This should change now.

Why?
At the moment I’m on Malta in the EC English School. 4 weeks – 6 hours English per day.
One of my goals is to learn writing understandable English. Therefore I will translate my Blog and my teacher will check this every day.