PT-2009-1268 · Oracle · Oracle Database

Joxean Koret · Publicado 2009-01-14 · Atualizado 2018-10-11 · CVE-2008-5440

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database version 7.0.5.0.0

Description The issue affects confidentiality, integrity, and availability. It is reportedly related to the msg parameter in the evtdump CGI module, potentially a format string vulnerability.

Recommendations For Oracle Database version 7.0.5.0.0, consider restricting access to the evtdump CGI module until a fix is available. Avoid using the msg parameter in the affected module to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2008-5440

Produtos afetados

Oracle Database

Referências · 9

• http://joxeankoret.com/blog/?p=41 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5440 · Nota de Segurança
• http://vupen.com/english/advisories/2009/0115 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-09-004 · Nota
• http://securityfocus.com/bid/33177 · Nota
• http://securityfocus.com/archive/1/500080/100/0/threaded · Nota
• http://secunia.com/advisories/33525 · Aviso do Fabricante
• http://securityfocus.com/archive/1/500078/100/0/threaded · Nota
• http://oracle.com/technetwork/topics/security/cpujan2009-097901.html · Nota