PT-2012-3435 · Oracle · Oracle Database

Joxean Koret · Publicado 2012-05-08 · Atualizado 2025-09-13 · CVE-2012-1675

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 10.2.0.3 through 10.2.0.5 Oracle Database versions 11.1.0.7 through 11.2.0.3

Description The issue allows remote attackers to execute arbitrary database commands. This can be achieved by performing a remote registration of a database instance or service name that already exists, and then conducting a man-in-the-middle attack to hijack database connections.

Recommendations For Oracle Database versions 10.2.0.3 through 10.2.0.5, update to a version that is not affected by this issue. For Oracle Database versions 11.1.0.7 through 11.2.0.3, update to a version that is not affected by this issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-1675

ORACLETNSPOISONCHECK

Produtos afetados

Oracle Database

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/oracle/tnspoison_checker.rb · Exploit
• 🔥 https://github.com/bongbongco/CVE-2012-1675 · Exploit
• 🔥 http://securityfocus.com/bid/53308 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2012/Apr/204 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00018.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75303 · Nota
• https://blogs.oracle.com/security/entry/security_alert_for_cve_2012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1675 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1675 · Nota
• http://seclists.org/fulldisclosure/2012/Apr/343 · Nota
• http://kb.cert.org/vuls/id/359816 · Nota
• http://xforce.iss.net/xforce/xfdb/75303 · Nota
• http://securitytracker.com/id?1027000 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2013:150 · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html · Aviso do Fabricante