Alexander Kornbrust Oracle Security Blog

I found an interesting whitepaper „Securing the Enterprise with Intel AES-NI“ from Intel.

This white paper explains how the new AES-NI instructions in Intel Xeon 5600 series can improve the AES encryption/decryption. When I read the first time about this feature I was impressed.

OpenSSL (AES part) is up to 7 times faster with this new instruction set.

Intel did also some tests with Oracle 11g and Transparent Data Encryption (TDE) in AES-256 CBC mode. The usage of the optimized Intel Integrated Performance Primitives (IPP) shows an 89 percent reduction (3.33 GHz Xeon X5680 vs 2.8 Intel Xeon X5560) against a previous processor.

This is a huge advantage and if you use TDE you should think about using such a new processor.

Yesterday Oracle released the CPU April 2010 Pre-Release. These patches will fix 47 security vulnerabilites. The database patch itself will contain 7 new security vulnerability fixes. None of these vulnerabilities are remote exploitable without authentication.

The highest CVSS base score for the Oracle database is 7.5.

The following components are affected:

• Change Data Capture
• Core RDBMS
• JavaVM
• Oracle XDB
• RDBMS Security
• XML DB

Oracle will fix one of my findings in the April 2010 CPU.

At the DOAG Expertenseminar „Oracle Hardening & Patching / Auditing & Co.“ in Berlin (26.04.2010 – 27.04.2010) I will talk about this CPU as well. If you are interested you can attend this 2 day seminar.

Joxean Koreat has released his presentation „Hackproofing Oracle Financials 11i / R12“ from RootedCON 2010. Joxean shows some nice ways to own old and new Oracle Financials installations.

Thanks to Sid for the link via twitter.