PT-2009-3563 · Oracle · Oracle Database

Alexander Kornbrust · Publicado 2009-04-15 · Atualizado 2018-10-10 · CVE-2009-0981

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database version 11.1.0.7

Description The issue affects confidentiality and is related to the APEX component in Oracle Database. It allows remote authenticated users to potentially obtain APEX password hashes from the WWV FLOW USERS table via a SELECT statement.

Recommendations For Oracle Database version 11.1.0.7, consider restricting access to the WWV FLOW USERS table as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2009-0981

Produtos afetados

Oracle Database

Referências · 11

• 🔥 https://exploit-db.com/exploits/8456 · Exploit
• http://securityfocus.com/archive/1/502724/100/0/threaded · Nota
• http://red-database-security.com/advisory/apex_password_hashes.html · Nota
• http://securityfocus.com/bid/34461 · Nota
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0981 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0981 · Nota de Segurança
• http://secunia.com/advisories/34693 · Nota
• http://securitytracker.com/id?1022052 · Nota
• http://osvdb.org/53738 · Nota