PT-2007-7136 · Oracle · Oracle 11G+3

Publicado 2007-12-06 · Atualizado 2018-10-15 · CVE-2007-6260

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle 10g and 11g versions (affected versions not specified)

Description The issue is related to the installation process using default passwords for accounts, allowing remote attackers to gain login access by connecting to the Listener. It is noted that when the Database Configuration Assistant (DBCA) is used at the end of the installation, most accounts are either disabled or have their passwords changed.

Recommendations For Oracle 10g and 11g, consider changing the default passwords for accounts after installation to prevent unauthorized access. As a temporary workaround, restrict access to the Listener to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2007-6260

Produtos afetados

Database Configuration Assistant

Listener

Oracle 10G

Oracle 11G

Referências · 7

• http://securityreason.com/securityalert/3419 · Nota
• http://davidlitchfield.com/blog/archives/00000030.htm · Nota
• http://osvdb.org/43673 · Nota
• http://oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf · Nota
• http://securityfocus.com/archive/1/483652/100/200/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6260 · Nota de Segurança
• http://securityfocus.com/bid/26425 · Nota