PT-2001-2187 · Oracle · Oracle

Publicado 2001-08-31 · Atualizado 2016-10-18 · CVE-2001-1041

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle versions 8.0.x through 9.0.1

Description The issue allows local users to overwrite arbitrary files via a symlink attack on an Oracle log trace (.trc) file. This is made possible by the program creating the log file in an alternate home directory identified by the ORACLE HOME environment variable.

Recommendations For Oracle versions 8.0.x through 9.0.1, consider restricting access to the ORACLE HOME environment variable to minimize the risk of exploitation. As a temporary workaround, avoid using the Oracle log trace (.trc) file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2001-1041

Produtos afetados

Oracle

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1041 · Nota
• http://marc.info/?l=bugtraq&m=99677282117387&w=2 · Nota
• http://marc.info/?l=bugtraq&m=100395579811880&w=2 · Nota
• http://securityfocus.com/bid/3135 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1041 · Nota de Segurança
• http://otn.oracle.com/deploy/security/pdf/oracle_race.pdf · Nota