PT-2010-2593 · Oracle · Oracle Database

Publicado 2010-04-13 · Atualizado 2012-10-23 · CVE-2010-0870

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:N/AC:H/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database version 9.2.0.8 Oracle Database version 9.2.0.8DV

Description The issue affects the confidentiality and integrity of the system, related to the SYS.DBMS CDC PUBLISH function in the Change Data Capture component. It can be exploited by remote authenticated users.

Recommendations For Oracle Database version 9.2.0.8, consider restricting access to the Change Data Capture component until a fix is available. For Oracle Database version 9.2.0.8DV, consider restricting access to the Change Data Capture component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2010-0870

Produtos afetados

Oracle Database

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/sqli/oracle/dbms_cdc_publish2.rb · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0870 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0870 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpuapr2010-099504.html · Nota
• http://secunia.com/advisories/39438 · Nota
• http://us-cert.gov/cas/techalerts/TA10-103B.html · Nota