PT-2010-3974 · Oracle · Oracle Database Server+2

Publicado 2010-10-13 · Atualizado 2010-11-11 · CVE-2010-2390

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.1.0.5 through 10.1.0.5 Oracle Database Server versions 10.2.0.3 through 10.2.0.3 Oracle Fusion Middleware versions 10.1.2.3 through 10.1.2.3 Oracle Fusion Middleware versions 10.1.4.3 through 10.1.4.3 Enterprise Manager Grid Control (affected versions not specified)

Description The issue affects the Database Control component in EM Console, allowing remote attackers to impact confidentiality, integrity, and availability. The vectors used for the attack are unknown.

Recommendations For Oracle Database Server version 10.1.0.5, update to a version that includes the fix for this issue. For Oracle Database Server version 10.2.0.3, update to a version that includes the fix for this issue. For Oracle Fusion Middleware version 10.1.2.3, update to a version that includes the fix for this issue. For Oracle Fusion Middleware version 10.1.4.3, update to a version that includes the fix for this issue. For Enterprise Manager Grid Control, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2010-2390

Produtos afetados

Enterprise Manager Grid Control

Oracle Database Server

Oracle Fusion Middleware

Referências · 4

• http://us-cert.gov/cas/techalerts/TA10-287A.html · Nota
• http://oracle.com/technetwork/topics/security/cpuoct2010-175626.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2390 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2390 · Nota de Segurança