PT-2010-1896 · Oracle · Oracle Secure Backup

Publicado 2010-01-12 · Atualizado 2012-10-23 · CVE-2010-0072

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Secure Backup version 10.2.0.3

Description The issue affects confidentiality, integrity, and availability. It is reportedly related to a buffer overflow in observiced.exe, allowing remote attackers to execute arbitrary code via vectors related to a "reverse lookup of connections" to TCP port 10000, specifically the API endpoint related to TCP port 10000.

Recommendations For Oracle Secure Backup version 10.2.0.3, consider disabling the observiced.exe component to minimize the risk of exploitation until a patch is available. Restrict access to TCP port 10000 to reduce the attack surface.

Correção

Identificadores relacionados

CVE-2010-0072

ZDI-10-002

Produtos afetados

Oracle Secure Backup

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-0072 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA10-012A.html · Nota
• https://zerodayinitiative.com/advisories/ZDI-10-002 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpujan2010-084891.html · Nota