PT-2007-1742 · Oracle · Oracle Database

Publicado 2007-01-17 · Atualizado 2018-10-16 · CVE-2007-0270

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.2.0.7 and 10.1.0.4

Description The issue is related to a buffer overflow in SYS.DBMS DRS, which can be exploited by remote authenticated users. This can lead to a denial of service (crash) or the execution of arbitrary code via the GET PROPERTY function in SYS.DBMS DRS.

Recommendations For Oracle Database version 9.2.0.7, consider disabling the GET PROPERTY function in SYS.DBMS DRS as a temporary workaround until a patch is available. For Oracle Database version 10.1.0.4, consider disabling the GET PROPERTY function in SYS.DBMS DRS as a temporary workaround until a patch is available.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-0270

Produtos afetados

Oracle Database

Referências · 12

• http://us-cert.gov/cas/techalerts/TA07-017A.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-0270 · Nota de Segurança
• http://securityfocus.com/archive/1/474050/100/0/threaded · Nota
• http://oracle.com/technetwork/topics/security/cpujan2007-101493.html · Nota
• http://osvdb.org/32909 · Nota
• http://securityfocus.com/archive/1/458036/100/0/threaded · Nota
• http://securitytracker.com/id?1017522 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31541 · Nota
• http://securityfocus.com/bid/22083 · Nota
• http://secunia.com/advisories/23794 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0270 · Nota
• http://appsecinc.com/resources/alerts/oracle/2007-04.shtml · Nota