Which RDBMS is very secure: SQL Server vs. Oracle

I found this nice comparison between Oracle and SQL Server in Security:

Let's zoom-in into the graph a little bit:

Now as you see no security flaws have been reported in SQL Server 2005 since it has been released.

Interpretation of results - some Q and A

Do Oracle’s results look so bad because it runs on multiple platforms?
No – pretty much most of the issues are cross-platform. In the 10gR2 graph every flaw affects every platform.

Do the SQL Server 2005 results have no flaws because no-one is looking at it?
No – I know of a number of good researchers are looking at it – SQL Server code is just more secure than Oracle code.

Do you have any predictions on the Oracle January 2007 Critical Patch Update?
Maybe – NGSSoftware are currently waiting for Oracle to fix 49 security flaws – these will be fixed sometime in 2007 and 2008.

Do these results contain unfixed flaws?
No – only those that have been publicly reported and fixed are in the data.

Why have there been so little bugs found in SQL Server since 2002?
Three words: Security Development Lifecycle – SDL. SDL is far and above the most important factor. A key benefit of employing SDL means that knowledge learnt after finding and fixing screw ups is not lost; instead it is ploughed back into to the cycle. This means rather than remaking the same mistakes elsewhere you can guarantee that new code, whilst not necessarily completely secure, is at least more secure than the old code.


Microsoft SQL Server
Security issues and fixes in SQL Server 7, 2000 and 2005 since December 2000 to November 2006. Five MDAC security flaws over this period of time have not been included in these results because MDAC is part of Windows and not SQL Server.

Oracle
Security issues and fixes in Oracle 8, 9 and 10 since December 2000 to November 2006.Only security issues found in the TNS Listener and the RDBMS itself have been includedin the following graph. This means issues found in components such as the IntelligentAgent or the Oracle Application Server have not been included.

Source:
http://www.databasesecurity.com/dbsec/comparison.pdf

More Information:
http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-cerrudo.pdf