PT-2000-1747 · Oracle · Oracle Listener

Published 2000-12-19 · Updated 2017-10-10 · CVE-2000-0818

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle listener program versions 7.3.4, 8.0.6, 8.1.6

Description The default installation of the Oracle listener program allows an attacker to cause logging information to be appended to arbitrary files and execute commands via the SET TRC FILE or SET LOG FILE commands.

Recommendations For versions 7.3.4, 8.0.6, and 8.1.6, consider restricting access to the SET TRC FILE and SET LOG FILE commands to prevent arbitrary file appending and command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2000-0818

Affected Products

Oracle Listener

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-0818 · Security Note
• http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf · Vendor Advisory
• http://xforce.iss.net/alerts/advise66.php · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5380 · Note