PT-2008-3353 · Oracle · Oracle Database

Publicado

2008-04-16

·

Atualizado

2018-10-11

·

CVE-2008-1821

CVSS v2.0

9.0

Alta

VetorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5 FIPS+ and 10.1.0.5
Description The issue concerns an unspecified vulnerability in the Advanced Queuing component, with potential remote attack vectors. It is related to SYS.DBMS AQJMS INTERNAL. Researchers claim that the vulnerability may be due to multiple buffer overflows in the (1) AQ$ REGISTER and (2) AQ$ UNREGISTER procedures. The current Oracle version has vulnerabilities that allow remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data.
Recommendations For Oracle Database version 9.0.1.5 FIPS+, update to a version that addresses the buffer overflows in the AQ$ REGISTER and AQ$ UNREGISTER procedures. For Oracle Database version 10.1.0.5, update to a version that addresses the buffer overflows in the AQ$ REGISTER and AQ$ UNREGISTER procedures. As a temporary workaround, consider restricting access to the SYS.DBMS AQJMS INTERNAL component until a patch is available.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2008-1821

Produtos afetados

Oracle Database