PT-2011-1520 · Oracle · Oracle Goldengate Veridata

Andrea Micalizzi + 1 · Publicado 2011-01-18 · Atualizado 2017-08-17 · CVE-2010-4416

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate Veridata version 3.0.0.4

Description The issue affects the availability of the system. It is reportedly related to the parsing of XML SOAP requests by the Server component. A reliable third-party researcher claims this could be a buffer overflow vulnerability, potentially triggered by a crafted XML SOAP request with a value lacking the expected 0x20 terminator character.

Recommendations For Oracle GoldenGate Veridata version 3.0.0.4, consider restricting access to the Server component to minimize the risk of exploitation until a patch is available. Avoid using crafted XML SOAP requests that could trigger the buffer overflow. As a temporary workaround, consider implementing additional validation on XML SOAP requests to ensure they contain the expected 0x20 terminator character.

Correção

Identificadores relacionados

CVE-2010-4416

ZDI-11-019

Produtos afetados

Oracle Goldengate Veridata

Referências · 10

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4416 · Nota
• http://secunia.com/advisories/42979 · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-11-019 · Nota
• https://zerodayinitiative.com/advisories/ZDI-11-019 · Nota de Segurança
• http://securityfocus.com/bid/45868 · Nota
• http://securitytracker.com/id?1024981 · Nota
• http://vupen.com/english/advisories/2011/0143 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64775 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4416 · Nota de Segurança