PT-2006-1336 · Oracle · Oracle Database Server
Alexander Kornbrust
·
Publicado
2006-01-18
·
Atualizado
2018-10-19
·
CVE-2006-0261
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5
Description
The issue involves unspecified vulnerabilities in the Oracle Database server, affecting the Dictionary and Oracle Label Security components. It is reported that one of the vulnerabilities, DB07, involves the plaintext storage of the TDE wallet password in a trace file by event 10053.
Recommendations
For Oracle Database server version 8.1.7.4, update to a version that addresses the storage of sensitive information in plaintext.
For Oracle Database server version 9.0.1.5, update to a version that addresses the storage of sensitive information in plaintext.
For Oracle Database server version 9.2.0.7, update to a version that addresses the storage of sensitive information in plaintext.
For Oracle Database server version 10.1.0.5, update to a version that addresses the storage of sensitive information in plaintext.
As a temporary workaround, consider restricting access to the trace files generated by event 10053 to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Oracle Database Server