PT-2005-3222 · Oracle · Oracle Forms

Alexander Kornbrust · Publicado 2005-07-17 · Atualizado 2017-07-11 · CVE-2005-2294

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Forms versions 4.5, 6.0, 6i, and 9i

Description: The issue allows local users to gain sensitive information, such as credit card numbers, when a large number of records are retrieved by an Oracle form. This occurs because the system stores a copy of the database tables in a world-readable temporary file.

Recommendations: For Oracle Forms versions 4.5, 6.0, 6i, and 9i, consider restricting access to the temporary files generated by the system to minimize the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2294

Produtos afetados

Oracle Forms

Referências · 6

• http://marc.info/?l=bugtraq&m=112129398711846&w=2 · Nota
• http://oracle.com/technology/deploy/security/pdf/cpujul2005.html · Aviso do Fabricante
• http://red-database-security.com/advisory/oracle_forms_unsecure_temp_file_handling.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21347 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2294 · Nota de Segurança
• http://secunia.com/advisories/15991 · Aviso do Fabricante