David Litchfield, a well known security expert, has created a report that compares the security flaws found in Oracle with those found in SQL Server. According to his report SQL Server 2005 is more secure than Oracle 10G Release 2 and he says that this is tanks to the Security Development Lifecycle.
Although there are indeed no known security flaws in SQL Server 2005 you must know that SQL Server 2005 uses several components that are not directly part of the SQL Server core and it in these components there were several security flaws found. Imho these flaws should have been taken account for in the report because a chain is as strong as its weakest link.
You can read the report here
Source
Cross-posted from
The .NET Aficionado