PT-2004-2611 · Oracle · Oracle 8I+2

Publicado 2004-07-30 · Atualizado 2017-07-11 · CVE-2004-1707

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle 8i Oracle 9i Oracle IAS version 9.0.2.0.1

Description The issue concerns the dbsnmp and nmo programs in Oracle products on Unix systems. These programs use a default path to find and execute library files while operating at raised privileges. This allows certain Oracle user accounts to gain root privileges by modifying the libclntsh.so.9.0 library file.

Recommendations For Oracle 8i, update the configuration to use a secure path for library files. For Oracle 9i, modify the privileges of the affected Oracle user accounts to prevent them from executing the vulnerable library files. For Oracle IAS version 9.0.2.0.1, restrict access to the libclntsh.so.9.0 library file to prevent modification by unauthorized users.

Exploit

Correção

Identificadores relacionados

CVE-2004-1707

Produtos afetados

Oracle 8I

Oracle 9I

Oracle Ias

Referências · 7

• 🔥 https://exploit-db.com/exploits/24335 · Exploit
• 🔥 http://secunia.com/advisories/12205 · Exploit
• http://marc.info/?l=bugtraq&m=109147677214087&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1707 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1707 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16839 · Nota
• http://securityfocus.com/bid/10829 · Aviso do Fabricante