PT-2007-3452 · Oracle · Oracle Database

David Litchfield · Publicado 2007-04-18 · Atualizado 2018-10-16 · CVE-2007-2110

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5 and later, 9.2.0.7, 10.1.0.4

Description The issue concerns an unspecified vulnerability in the Core RDBMS component of Oracle Database. It is reported that this vulnerability may allow local users to inject threads and execute arbitrary code via the OpenProcess, OpenThread, and SetThreadContext functions. This is allegedly due to the RDBMS using a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections.

Recommendations For Oracle Database versions 9.0.1.5 and later, 9.2.0.7, 10.1.0.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-2110

Produtos afetados

Oracle Database

Referências · 13

• http://ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2110 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2110 · Nota de Segurança
• http://red-database-security.com/advisory/oracle_cpu_apr_2007.html · Nota
• http://vupen.com/english/advisories/2007/1426 · Aviso do Fabricante
• http://freelists.org/archives/oracle-l/12-2006/msg00004.html · Nota
• http://integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf · Nota
• http://securitytracker.com/id?1017927 · Nota
• http://securityfocus.com/bid/23532 · Nota
• http://securityfocus.com/archive/1/466329/100/200/threaded · Aviso do Fabricante
• https://blackhat.com/presentations/bh-dc-07/Cerrudo/Presentation/bh-dc-07-Cerrudo-ppt.pdf · Nota
• http://us-cert.gov/cas/techalerts/TA07-108A.html · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2007-090632.html · Nota