PT-2011-1553 · Oracle · Oracle Audit Vault

Publicado 2011-01-18 · Atualizado 2017-08-17 · CVE-2010-4449

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Audit Vault version 10.2.3.2

Description The issue affects the confidentiality, integrity, and availability of the system. It is related to a crafted parameter in an action.execute request to the av component on TCP port 5700, specifically the /av.action endpoint, with the action.execute request potentially allowing remote code execution.

Recommendations For Oracle Audit Vault version 10.2.3.2, consider restricting access to the av component on TCP port 5700 to minimize the risk of exploitation. Avoid using the potentially vulnerable parameter in the action.execute request to the /av.action endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2010-4449

ZDI-11-017

Produtos afetados

Oracle Audit Vault

Referências · 10

• https://zerodayinitiative.com/advisories/ZDI-11-017 · Nota de Segurança
• http://securityfocus.com/bid/45844 · Nota
• http://securitytracker.com/id?1024973 · Nota
• http://osvdb.org/70583 · Nota
• http://zerodayinitiative.com/advisories/ZDI-11-017 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4449 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0141 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64762 · Nota
• http://oracle.com/technetwork/topics/security/cpujan2011-194091.html · Aviso do Fabricante
• http://secunia.com/advisories/42919 · Aviso do Fabricante