Pete Finnigan's Oracle Security Weblog

Pete Finnigan says:

The problem with the Oracle CVSS scores has everything to do with CVSS and not much about Oracle manipulating the scores. To achieve a high CVSS base metric, root access needs to be gained, which is difficult to do against a properly configured Oracle database. What is not taken into account with the score is that the entire database or application can be compromised. The CVSS focus is really on servers and routers rather than databases and applications. This is why Oracle uses the Partial+ rating. This has been an issue ever since Oracle began using CVSS. From a year-ago, you can read my blog post on the topic --

http://www.integrigy.com/oracle-security-blog/archive/2006/10/27/oracle-cvss

Pete Finnigan says:

Hi Steve,

Thanks for your comment. I was not meaning to suggest that Oracle manipulated the scores i was making a dig at the method used, perhaps I shoulod have explained better. Thanks for the link to your blog entry, its interesting. In the case of Oracle using CVSS its a case of the customers being fully aware of what the realistic maximums are and what they mean. The issue for me is that for some thief to steal say credit card data is a full compromise of the business and root access is not needed. Customres of Oracle need to understand that a lower score is in their case a full compromise.

thanks again for the link

cheers

Pete