A German security consultancy has disclosed details of several flaws in Oracle products first reported to Oracle two years ago. The move has reignited debate over bug disclosure and may encourage others to release details of unfixed flaws, potentially putting corporate systems at greater risk.

Alexander Kornbrust of Red Database Security (RDS), which released the details, said the flaws were reported to Oracle between July and September 2003, and were all confirmed.

Kornbrust said the flaws affect Oracle Reports and Forms, which are integrated into Oracle's Application Server and E-Business Suite. Three are rated by RDS as high risk and at least one would allow attackers to compromise systems via the internet, he added. Patches have yet to be released.

"Oracle's behaviour [in leaving flaws unfixed] is not acceptable. Oracle put [its] customers in danger," Kornbrust wrote in an RDS alert.

Oracle responded with a statement saying its policy is that "higher severity vulnerabilities are fixed as a priority over lower severity vulnerabilities". It added, "We are disappointed when any details of Oracle product security vulnerabilities are released before patches can be made available."

Security experts often argue against disclosure before patches are available, but opinion may be changing. "If the [vendor] isn't interested and doesn't seem to be acting [to fix the flaw] after a period of time maybe you should go public," said Adrian Davis, project manager at the Information Security Forum. However, Davis added that early disclosure has dangers if the details can be exploited by hackers.

In an email to IT Week, Ronan Miles, chairman of the Oracle User Group, said he would ask the database giant for a "full commentary" on the unfixed vulnerabilities. Although the group is against such early disclosure, Miles said it understood why RDS had released the information.

The flaws include weaknesses that would allow attackers to execute commands with system privileges, as well as file overwriting, information disclosure and cross-site scripting attacks.