PT-2007-1745 · Oracle · Oracle Database

Alexander Kornbrust · Publicado 2007-01-17 · Atualizado 2017-07-29 · CVE-2007-0273

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3

Description The issue concerns an unspecified vulnerability related to XMLDB, potentially allowing for multiple cross-site scripting (XSS) attacks. The impact and attack vectors of this issue are unknown.

Recommendations For Oracle Database version 9.0.1.5, update to a version that addresses the XMLDB-related issue. For Oracle Database version 9.2.0.8, update to a version that addresses the XMLDB-related issue. For Oracle Database version 10.1.0.5, update to a version that addresses the XMLDB-related issue. For Oracle Database version 10.2.0.3, update to a version that addresses the XMLDB-related issue. As a temporary workaround, consider restricting access to XMLDB components to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-0273

Produtos afetados

Oracle Database

Referências · 10

• http://us-cert.gov/cas/techalerts/TA07-017A.html · Correção
• http://oracle.com/technetwork/topics/security/cpujan2007-101493.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0273 · Nota
• http://osvdb.org/32912 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0273 · Nota de Segurança
• http://securitytracker.com/id?1017522 · Nota
• http://red-database-security.com/advisory/oracle_xmldb_css2.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31541 · Nota
• http://securityfocus.com/bid/22083 · Nota
• http://secunia.com/advisories/23794 · Aviso do Fabricante