PT-2003-2145 · Oracle · Oracle9I Application Server

Publicado 2003-11-03 · Atualizado 2017-07-11 · CVE-2003-1193

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Oracle9i Application Server versions 9.0.2.00 through 3.0.9.8.5

Description The issue concerns multiple SQL injection vulnerabilities in various components of Oracle Oracle9i Application Server, including the Portal DB's List of Values (LOVs), Forms, Hierarchy, and XML components packages. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the URL.

Recommendations For Oracle Oracle9i Application Server versions 9.0.2.00 through 3.0.9.8.5, update to a version that includes the necessary security patches to fix the SQL injection vulnerabilities in the affected components.

Correção

Identificadores relacionados

CVE-2003-1193

Produtos afetados

Oracle9I Application Server

Referências · 5

• http://otn.oracle.com/deploy/security/pdf/2003alert61.pdf · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2003-1193 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13593 · Nota
• http://securityfocus.com/archive/1/343520 · Aviso do Fabricante
• http://securityfocus.com/bid/8966 · Aviso do Fabricante