PT-2008-4043 · Oracle · Oracle Application Server

Publicado 2008-07-15 · Atualizado 2018-10-11 · CVE-2008-2589

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Application Server versions 9.0.4.3 through 10.1.4.1

Description The issue has unknown impact and can be exploited remotely. It may be related to a SQL injection vulnerability in the WWV RENDER REPORT package, potentially allowing remote attackers to execute arbitrary SQL (PL/SQL) commands via the second argument to the SHOW procedure.

Recommendations For Oracle Application Server versions 9.0.4.3 through 10.1.4.1, consider restricting access to the WWV RENDER REPORT package as a temporary workaround until a patch is available. Avoid using the second argument to the SHOW procedure in the affected package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2008-2589

Produtos afetados

Oracle Application Server

Referências · 10

• http://secunia.com/advisories/31087 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2115 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2589 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpujul2008-090335.html · Nota
• http://vupen.com/english/advisories/2008/2109/references · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2589 · Nota
• http://securityfocus.com/archive/1/494410/100/0/threaded · Nota
• http://secunia.com/advisories/31113 · Aviso do Fabricante
• http://securitytracker.com/id?1020494 · Nota
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 · Aviso do Fabricante