PT-2000-1747 · Oracle · Oracle Listener

Publicado 2000-12-19 · Atualizado 2017-10-10 · CVE-2000-0818

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle listener program versions 7.3.4, 8.0.6, 8.1.6

Description The default installation of the Oracle listener program allows an attacker to cause logging information to be appended to arbitrary files and execute commands via the SET TRC FILE or SET LOG FILE commands.

Recommendations For versions 7.3.4, 8.0.6, and 8.1.6, consider restricting access to the SET TRC FILE and SET LOG FILE commands to prevent arbitrary file appending and command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2000-0818

Produtos afetados

Oracle Listener

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-0818 · Nota de Segurança
• http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf · Aviso do Fabricante
• http://xforce.iss.net/alerts/advise66.php · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5380 · Nota