PT-2009-3575 · Oracle · Oracle Application Server

Joxean Koret · Publicado 2009-04-15 · Atualizado 2021-07-13 · CVE-2009-0993

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Application Server version 10.1.2.3

Description The issue affects confidentiality, integrity, and availability. It is reportedly related to the handling of HTTP POST requests, potentially allowing remote attackers to execute arbitrary code via format string specifiers in the URI, which are not properly handled when logging to opmn/logs/opmn.log.

Recommendations For Oracle Application Server version 10.1.2.3, consider restricting access to the OPMN component until a fix is available. As a temporary workaround, avoid using format string specifiers in HTTP POST URIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2009-0993

Produtos afetados

Oracle Application Server

Referências · 10

• https://exchange.xforce.ibmcloud.com/vulnerabilities/50030 · Nota
• http://securityfocus.com/bid/34461 · Nota
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Nota
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Nota
• http://securitytracker.com/id?1022055 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0993 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-09-017 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0993 · Nota
• http://secunia.com/advisories/34693 · Nota
• http://securityfocus.com/archive/1/502683/100/0/threaded · Nota