Category Archives: Database

Oracle Issues Security Fixes for MySQL, Other Database Products

Database developers were put on watch this week as Oracle issued a Critical Patch Update targeting 86 security vulnerabilities, including 18 for its MySQL database products.

Also affected are Oracle Database 11g Release 2 and earlier versions, Oracle Database Mobile Server and Oracle Database Lite Server.

The security vulnerabilities for MySQL, which Oracle acquired when it purchased Sun Microsystems in 2009, range in severity from 3.5 to 9.0 on the standard CVSS Base Score risk index. Two of the MySQL vulnerabilities can be exploited remotely by attackers with no authorization/authentication credentials.

Two Mobile/Lite products were rated 10.0 on the CVSS scale.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," Oracle said in its January 2013 patch update advisory.

The MySQL vulnerabilities affect subcomponents such as InnoDB, server optimization, parsing, privileges, stored procedures, replication and others. Oracle said successful attacks that exploit these vulnerabilities can result in OS hangs, denial-of-service crashes and, most seriously, OS takeovers and execution of arbitrary code. Server privileges and server parsing were the MySQL subcomponents receiving the highest security risk grade of 9.0, although that rating is only for Windows-based products, with Linux, Unix and other platform products receiving a lower risk rating.

Other Oracle products affected by the January 2013 patch update include E-Business Suite, PeopleSoft products, JD Edwards products, Siebel CRM, Fusion Middleware and several others.

Oracle also provided some temporary workaround guidance until the patch updates can be applied. "Until you apply the CPU fixes, it may be possible to reduce the risk of successful attack by blocking network protocols required by an attack," Oracle said. "For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from users that do not need the privileges may help reduce the risk of successful attack. Both approaches may break application functionality, so Oracle strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem."

Oracle issues critical patch updates four times each year, in January, April, July and October.

Source: http://adtmag.com/articles/2013/01/18/oracle-security-patches.aspx

Did you like this? Share it:

Can NoSQL Really Beat Relational Database?

At present, NoSQL can hardly compete with the traditional relational database; even it is hard to be as advanced as MySQL, an open source database. The database revolution of NoSQL still requires us to wait. In the short term, NoSQL has no advantages over relational database.

I. The background of NoSQL

NoSQL’s supporters are fond of NoSQL for its advantages of performance. Supporters of NoSQL said that, NoSQL has made a breakthrough in the performance which is the bottom neck of most traditional relational database. For example, with the NoSQL architecture, you can save the time spent in transferring the Web or Java apps and data into the SQL friendly format and also the time spent in parsing and optimizing SQL sentences, to accelerate the speed of apps.

Despite the fact that the performance is the bottom neck of relational database based on SQL, the problem is not caused by the SQL technology, but resulted from the bad design of tables , indexes of tables or arrangement of space. We should not always blame the technology when the performance is not good. Usually, if we optimize the design of the database, we can improve the performance a lot. Thus, the background of NoSQL shows no superiority.

II. The NoSQL Revolution requires us to wait

According to the current situation, the prospect of NoSQL is not so promising to me. Or I am pessimistic about the future of NoSQL. NoSQL can hardly compete with the traditional relational database; even it is hard to be as advanced as MySQL, an open source database.

1) NoSQL can hardly keep the integrity of data

NoSQL has not given me a good impression. As far as I know, many excellent and practical functions of relational database cannot be used with a NoSQL database. With any relational database, the integrity of data is easy to keep. Take the Oracle database as an example; it is easy for you to achieve the goals such as the integrity of entities, referential integrity and so on.

NoSQL supporters also admit that in terms of data integrity, relational database is irreplaceable. But they still quibble that a company will not use such complex functions. I can barely agree with it. The data integrity is essential to every app of every company. For instance, most apps at least need the process of the user identification, so the database should store the users’ names. For the users’ name has something to do with the identification, the user’s name should be entirely different from each other, so the unique constraints have to be used. In a relational database, you just have to set the user name as uniqueness. With NoSQL, the uniqueness should be determined by codes. What is easy to do with relational database will be complicated for SQL? So in my opinion, the NoSQL can hardly be popular in a computer. In the short term, we are still supposed to wait for the NoSQL revolution.

2) It lacks powerful technological support

Up till now, all projects of NoSQL are open source, which means it lacks official support of technicists of suppliers. As other open source projects, NoSQL projects have to seek for support from communities. However, NoSQL projects are much harder than open source projects. NoSQL projects are the most basic equipments of network applications. If they go wrong, the consequences will be very serious, and also, the users will find no one to turn to and complain to. NoSQL is still in the stage of research, if it should be applied by companied and accepted by database administrators, it has to be improved at least in terms of stability.

When a problem shows up, the database administrator has to repair the operation faults. Without powerful support, being afraid that the problem will not be solved in time, most administrators will refuse to use NoSQL projects.

3) It will take long for an open source database from being released to being accepted by users.

Assume the NoSQL technology can be accepted by users, but it will take a long time for them to accept finally. The open source database system MySQL became popular long after it was released, and it is based on a relatively mature relational database model. When it was designed and developed, there had been lots of good products that can be regarded as reference, and at least the SQL grammar can be used immediately, without designing from zero. But now, NoSQL is a product designed from zero, everything about it should be entirely new. Without the support of technicians of suppliers, it will be a long way. Even though it is popular among small and medium-sized companies just as MySQL, but owing to its weakness in technology, it will not perform competently when applied in large database.

4) Relational database is more practical when designing

In my opinion, the most valuable part of relational database is that it is convenient to design. The relational model between database objects is very helpful to the designing to database design, which greatly reflects the practical situation of the work. When designing an ERP system, the relationship between the primary key and the foreign key reflects the relationship between the product information table and the purchase order. But the NoSQL projects attempt to break such relationship, which will bring about lots of problems and make things more complicated during the process of designing. What is more important, the relationship between database objects is not just relationship, but also a powerful principle, and it will discipline all the relational database administrators, which means, all administrators have to conform to the principle.

In general, I oppose the NoSQL projects. At least recently, there will be hardly any decent products of NoSQL releasing to the market. In the short term, it cannot compete with relational database; maybe it will never have the chance.

Did you like this? Share it: