PT-2009-4434 · Oracle · Oracle Database

Publicado 2009-10-22 · Atualizado 2018-10-10 · CVE-2009-1979

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 10.1.0.5 through 10.2.0.4

Description: The issue affects the confidentiality, integrity, and availability of the system. It is related to the Network Authentication component. Details about real-world incidents where this issue was exploited are not provided. An independent researcher claims that the issue might be related to improper validation of the AUTH SESSKEY parameter length, potentially leading to arbitrary code execution.

Recommendations: For Oracle Database versions 10.1.0.5 through 10.2.0.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2009-1979

Produtos afetados

Oracle Database

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/oracle/tns_auth_sesskey.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16342 · Exploit
• 🔥 https://exploit-db.com/exploits/9905 · Exploit
• http://osvdb.org/59110 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1979 · Nota
• http://securitytracker.com/id?1023057 · Nota
• http://oracle.com/technetwork/topics/security/cpuoct2009-096303.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1979 · Nota de Segurança
• http://blogs.conus.info/node/28 · Nota
• http://securityfocus.com/archive/1/507598/100/0/threaded · Nota
• http://securityfocus.com/bid/36747 · Nota
• http://us-cert.gov/cas/techalerts/TA09-294A.html · Nota
• http://secunia.com/advisories/37027 · Nota