PT-2001-2096 · Oracle · Oracle

Publicado 2001-08-31 · Atualizado 2008-09-05 · CVE-2001-0943

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle versions 8.0.5 and 8.1.5

Description The issue allows local users to execute arbitrary code under certain conditions. This is due to the dbsnmp in Oracle trusting the PATH environment variable to find and execute the chown or chgrp commands. A local user can modify the PATH to point to Trojan Horse programs, enabling the execution of arbitrary code.

Recommendations For Oracle version 8.0.5, consider restricting access to the dbsnmp until a fix is available. For Oracle version 8.1.5, avoid using the PATH environment variable to execute the chown or chgrp commands until the issue is resolved. As a temporary workaround, consider setting the PATH environment variable to a known safe value to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-0943

Produtos afetados

Oracle

Referências · 6

• 🔥 http://securityfocus.com/archive/1/201020 · Exploit
• http://seclists.org/lists/bugtraq/2001/Dec/0001.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0943 · Nota de Segurança
• http://securityfocus.com/bid/3129 · Aviso do Fabricante
• http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0943 · Nota