PT-2016-5125 · Allround Automations · Pl/Sql Developer

Adam Caudill · Publicado 2016-04-25 · Atualizado 2016-05-04 · CVE-2016-2346

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allround Automations PL/SQL Developer version 11.0.6 and earlier, specifically versions prior to 11.0.6

Description The issue allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream, as the software relies on unverified HTTP data for updates.

Recommendations For versions prior to 11.0.6, update to version 11.0.6 or later to resolve the issue.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2016-2346

Produtos afetados

Pl/Sql Developer

Referências · 4

• 🔥 https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption · Exploit
• https://osv.dev/vulnerability/CVE-2016-2346 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2346 · Nota de Segurança
• http://kb.cert.org/vuls/id/229047 · Nota