PT-2007-3462 · Oracle · Oracle Application Server+1

Alexander Kornbrust · Publicado 2007-04-18 · Atualizado 2018-10-16 · CVE-2007-2120

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Application Server versions 9.0.4.3, 10.1.2.0.2, 10.1.2.2.0

Description The issue allows remote attackers to shut down an Oracle TNS Listener via a TNS STOP command in a request. This can be achieved by using the database/TNS alias.

Recommendations For Oracle Application Server version 9.0.4.3, update to a version that includes a fix for this issue. For Oracle Application Server version 10.1.2.0.2, update to a version that includes a fix for this issue. For Oracle Application Server version 10.1.2.2.0, update to a version that includes a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2007-2120

Produtos afetados

Oracle Application Server

Oracle Tns Listener

Referências · 11

• http://red-database-security.com/advisory/oracle_cpu_apr_2007.html · Nota
• http://vupen.com/english/advisories/2007/1426 · Aviso do Fabricante
• http://red-database-security.com/advisory/oracle_discoverer_servlet.html · Nota
• http://securitytracker.com/id?1017927 · Nota
• http://securityfocus.com/bid/23532 · Nota
• http://securityfocus.com/archive/1/466329/100/200/threaded · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2120 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2120 · Nota de Segurança
• http://securityfocus.com/archive/1/466160/100/0/threaded · Nota
• http://us-cert.gov/cas/techalerts/TA07-108A.html · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2007-090632.html · Nota