Pete Finnigan's Oracle Security Weblog

I got an email today to let me know about a good post by Marcus Ranum on his site titled "Teaching an Old Dog New Tricks" which talks about programming, bugs, exploits an most importantly about Fortify in some detail. This is the tool Oracle announced around a year ago that they had bought and were using internally to audit their own source code. This is a source code analizer that looks for bugs or potential bugs in software. The tool supports C and PL/SQL amongst other languages. This is a good tool but there is little information on the net about it, particularly the sorts of checks that it performs. This article is quite revealing in terms of what the tool does. There are a number of other free tools that can check C and C++ but not PL/SQL such as RATS, flawfinder, findbugs, ITS4, Prexis and splint.

If anyone has anymore details on what Fortify does particularly in terms of PL/SQL auditing I would be interested to know.