Let's give Microsoft SQL Server some credit
Oracle continues to gather attention for disclosing staggering numbers of vulnerabilities in their database products. It will be their turn to be on the hot seat for a while. While others are hammering away at Oracle, I took a look at Microsoft SQL Server to see how they are faring.
Microsoft has taken a ration of grief over the years for the security vulnerabilities that arise from buggy code. And they deserved it. Companies running their business on a technical infrastructure need to be sure that the infrastructure and the confidential information that the business produces can be trusted. With that background, Microsoft used SQL Server as the guinea pig for its Security Development Lifecycle. After a couple of years of hard engineering work, the early returns on SQL Server merit attention and respect.
I did a quick comparison of CVE submissions in 2006 for Microsoft and Oracle databases. I chose CVEs over bulletins and patches because the vendors have less ability to control CVE data. The numbers are amazing. I found but 2 CVE entries for Microsoft SQL Server so far in 2006 (!); I found 68 CVE entries for Oracle Database. (An equivalent search with “Microsoft + Database” also only yields 2 hits for 2006). I made no attempts to drill into the details of CVEs as a 30X difference really is the point.
Admittedly not all of these CVEs translate into security vulnerabilities, but it is pretty clear to me where I would want my confidential data to reside.



