Joxean Koret

**Name of the Vulnerable Software and Affected Versions** Oracle Database versions 10.2.0.3 through 10.2.0.5 Oracle Database versions 11.1.0.7 through 11.2.0.3 **Description** The issue allows remote attackers to execute arbitrary database commands. This can be achieved by performing a remote registration of a database instance or service name that already exists, and then conducting a man-in-the-middle attack to hijack database connections. **Recommendations** For Oracle Database versions 10.2.0.3 through 10.2.0.5, update to a version that is not affected by this issue. For Oracle Database versions 11.1.0.7 through 11.2.0.3, update to a version that is not affected by this issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Server version 10.1.2.3 **Description** The issue affects confidentiality, integrity, and availability. It is reportedly related to the handling of HTTP POST requests, potentially allowing remote attackers to execute arbitrary code via format string specifiers in the URI, which are not properly handled when logging to opmn/logs/opmn.log. **Recommendations** For Oracle Application Server version 10.1.2.3, consider restricting access to the OPMN component until a fix is available. As a temporary workaround, avoid using format string specifiers in HTTP POST URIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database version 7.0.5.0.0 **Description** The issue affects confidentiality, integrity, and availability. It is reportedly related to the `msg` parameter in the `evtdump` CGI module, potentially a format string vulnerability. **Recommendations** For Oracle Database version 7.0.5.0.0, consider restricting access to the `evtdump` CGI module until a fix is available. Avoid using the `msg` parameter in the affected module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Application Server versions 9.0.4.3, 10.1.2.3, 10.1.4.2 **Description** The issue concerns an unspecified vulnerability in the Oracle Internet Directory component. It is claimed by researchers to potentially cause a denial of service (crash) via a malformed LDAP request that triggers a NULL pointer dereference, although Oracle has not commented on this. The attack vector is remote. **Recommendations** For versions 9.0.4.3, 10.1.2.3, and 10.1.4.2, consider restricting access to the Oracle Internet Directory component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure.

The APPLSYS.FND DM NODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbitrary nodes. NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.

The ADI BINARY component in the Oracle E-Business Suite allows remote attackers to download arbitrary documents from the APPS.FND DOCUMENTS table via the ADI DISPLAY REPORT function, when passed a certain parameter. NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as CVE-2007-2126, CVE-2007-2127, or CVE-2007-2128.

Name of the Vulnerable Software and Affected Versions: HP LaserJet 5000 Series printers with firmware R.25.15 or R.25.47 HP LaserJet 5100 Series printers with firmware V.29.12 Description: The issue allows remote attackers to cause a denial of service, resulting in a device crash, by sending a long string in the LIST or NLST command. Recommendations: For HP LaserJet 5000 Series printers with firmware R.25.15, update the firmware to a version that is not affected by this issue. For HP LaserJet 5000 Series printers with firmware R.25.47, update the firmware to a version that is not affected by this issue. For HP LaserJet 5100 Series printers with firmware V.29.12, update the firmware to a version that is not affected by this issue.

Name of the Vulnerable Software and Affected Versions: Texas Imperial Software WFTPD Pro Server version 3.23.1.1 Description: The issue allows remote authenticated users to execute arbitrary code or cause a denial of service via crafted APPE commands that contain `/` or `` characters. Recommendations: For Texas Imperial Software WFTPD Pro Server version 3.23.1.1, consider restricting access to the APPE command until a patch is available. As a temporary workaround, avoid using the APPE command with `/` or `` characters to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: War FTP Daemon (WarFTPd) version 1.82.00-RC11 Description: The issue allows remote authenticated users to cause a denial of service by sending a large number of "%s" format strings in various commands, including CWD, CDUP, DELE, NLST, LIST, SIZE, and possibly others. Recommendations: For War FTP Daemon (WarFTPd) version 1.82.00-RC11, consider restricting access to the affected commands as a temporary workaround until a patch is available. Avoid using the vulnerable commands in the FTP daemon until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Digital Rights Management System (DRM) (affected versions not specified) **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long parameter to the `StoreLicense` function, which triggers memory corruption and possibly a buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 **Description** The issue is related to an unspecified vulnerability in the Net Listener component of the Oracle Database server. The impact and attack vectors of this issue are not specified. **Recommendations** For Oracle Database server version 8.1.7.4, update to a version that includes the fix for this issue. For Oracle Database server version 9.0.1.5, update to a version that includes the fix for this issue. For Oracle Database server version 9.0.1.5 FIPS, update to a version that includes the fix for this issue. For Oracle Database server version 9.2.0.7, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 9.2.0.6 and 10.1.0.4 **Description** The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified. **Recommendations** For Oracle Database server version 9.2.0.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Oracle Database server version 10.1.0.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 9.0.1.5, 9.2.0.7, and 10.1.0.5 **Description** The issue is related to an unspecified vulnerability in the Query Optimizer component of the Oracle Database server. The impact and attack vectors of this issue are not specified. **Recommendations** For Oracle Database server version 9.0.1.5, update to a version that includes the fix for this issue. For Oracle Database server version 9.2.0.7, update to a version that includes the fix for this issue. For Oracle Database server version 10.1.0.5, update to a version that includes the fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 10.1.0.5 through 10.2.0.1 **Description** The issue is related to an unspecified vulnerability in the Streams Capture component, potentially allowing SQL injection in the SET DIRECTORY ROOT function within the DBMS CDC PUBLISH package. Details about the vulnerability are limited due to unavailability from Oracle. **Recommendations** For Oracle Database server versions 10.1.0.5 through 10.2.0.1, consider restricting access to the DBMS CDC PUBLISH package as a temporary mitigation measure until a patch is available. Avoid using the SET DIRECTORY ROOT function in the affected package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite and Applications version 4.3 **Description** The issue concerns multiple unspecified vulnerabilities in the Oracle iLearning component, which have unspecified impact and attack vectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 **Description** The issue is related to an unspecified vulnerability in the Upgrade & Downgrade component, potentially allowing SQL injection in the DBMS REGISTRY package. This affects certain parameters to the following functions: (1) IS COMPONENT, (2) GET COMP OPTION, (3) DISABLE DDL TRIGGERS, (4) SCRIPT EXISTS, (5) COMP PATH, (6) GATHER STATS, (7) NOTHING SCRIPT, and (8) VALIDATE COMPONENTS. The estimated number of potentially affected devices and details about real-world incidents are not available. **Recommendations** For Oracle Database server version 8.1.7.4, consider disabling the DBMS REGISTRY package until a patch is available. For Oracle Database server version 9.0.1.5, restrict access to the DBMS REGISTRY package to minimize the risk of exploitation. For Oracle Database server version 9.2.0.7, avoid using the vulnerable functions in the DBMS REGISTRY package until the issue is resolved. For Oracle Database server version 10.1.0.4, consider applying configuration changes to limit the impact of the vulnerability, such as restricting access to the affected parameters.

**Name of the Vulnerable Software and Affected Versions** Oracle Database Server version 10.1.0.4.2 Oracle Application Server version 10.1.2.0.2 Oracle Collaboration Suite Release 2 version 9.0.4.2 (Oracle9i) **Description** The issue affects the Reorganize Objects & Convert Tablespace component and has an unspecified impact and attack vectors. **Recommendations** For Oracle Database Server version 10.1.0.4.2, update to a version that addresses this issue. For Oracle Application Server version 10.1.2.0.2, update to a version that addresses this issue. For Oracle Collaboration Suite Release 2 version 9.0.4.2 (Oracle9i), update to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server version 10.1.0.5 **Description** The issue affects the Oracle Database server and involves multiple unspecified vulnerabilities in various components, including the Data Pump, Net Listener, and Oracle Text components. Specifically, it is claimed by a reliable independent researcher that one of the vulnerabilities, DB06, is a SQL injection issue in certain functions within the DBMS DATAPUMP module, including `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`. The exact impact and attack vectors are not specified due to unavailable details from Oracle. **Recommendations** For Oracle Database server version 10.1.0.5, as a temporary workaround, consider restricting access to the affected functions in the DBMS DATAPUMP module, specifically `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 9.2.0.7 and 10.1.0.5 **Description** The issue involves multiple unspecified vulnerabilities in various components of the Oracle Database server, including the Data Pump, Oracle Text, Streams Apply, Streams Capture, and Streams Subcomponent. One of the vulnerabilities, DB05, is claimed by a reliable independent researcher to involve SQL injection in several functions within the DBMS METADATA UTIL, DBMS METADATA INT, and DBMS METADATA packages. These functions include `LONG2VARCHAR`, `LONG2VCMAX`, `LONG2VCNT`, `LONG2CLOB`, `MAKE FILTER`, `FETCH VIEWS ERROR`, `FETCH FILTERS`, `FETCH VIEWS`, `SET FILTER COMMON`, `DO FILTER SCRIPT`, `SET TABLE FILTERS`, `MAKE FILTER TEXT`, and `GET PREPOST TABLE ACT`. **Recommendations** For Oracle Database server version 9.2.0.7, consider disabling the affected functions in the DBMS METADATA UTIL, DBMS METADATA INT, and DBMS METADATA packages as a temporary workaround until a patch is available. For Oracle Database server version 10.1.0.5, consider disabling the affected functions in the DBMS METADATA UTIL, DBMS METADATA INT, and DBMS METADATA packages as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.