PT-2007-5647 · Oracle · Oracle Jinitiator Activex Control

Publicado 2007-08-31 · Atualizado 2018-10-15 · CVE-2007-4467

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle JInitiator ActiveX control (beans.ocx) versions 1.1.8.3 through 1.1.8.25 Oracle JInitiator ActiveX control (beans.ocx) versions 1.1.5.x and earlier Oracle JInitiator ActiveX control (beans.ocx) versions 1.1.7.x and earlier

Description The issue allows remote attackers to execute arbitrary code via unspecified initialization parameters, which can lead to multiple stack-based buffer overflows in the Oracle JInitiator ActiveX control.

Recommendations For versions 1.1.8.3 through 1.1.8.25, consider updating to a version later than 1.1.8.25 to resolve the issue. For versions 1.1.5.x and earlier, consider updating to a version later than 1.1.5.x to resolve the issue. For versions 1.1.7.x and earlier, consider updating to a version later than 1.1.7.x to resolve the issue. As a temporary workaround, consider restricting the use of initialization parameters in the Oracle JInitiator ActiveX control until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-4467

Produtos afetados

Oracle Jinitiator Activex Control

Referências · 10

• http://securityfocus.com/archive/1/479186/100/100/threaded · Nota
• http://kb.cert.org/vuls/id/474433 · Nota
• http://secunia.com/advisories/26644 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4467 · Nota de Segurança
• http://securityfocus.com/bid/25473 · Nota
• http://vupen.com/english/advisories/2007/3007 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36310 · Nota
• http://securitytracker.com/id?1018618 · Nota
• http://osvdb.org/37711 · Nota
• http://integrigy.com/security-resources/analysis/integrigy-oracle-jinitiator-vulnerability.pdf · Nota