PT-2001-2096 · Oracle · Oracle

Published 2001-08-31 · Updated 2008-09-05 · CVE-2001-0943

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle versions 8.0.5 and 8.1.5

Description The issue allows local users to execute arbitrary code under certain conditions. This is due to the dbsnmp in Oracle trusting the PATH environment variable to find and execute the chown or chgrp commands. A local user can modify the PATH to point to Trojan Horse programs, enabling the execution of arbitrary code.

Recommendations For Oracle version 8.0.5, consider restricting access to the dbsnmp until a fix is available. For Oracle version 8.1.5, avoid using the PATH environment variable to execute the chown or chgrp commands until the issue is resolved. As a temporary workaround, consider setting the PATH environment variable to a known safe value to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2001-0943

Affected Products

Oracle

References · 6

• 🔥 http://securityfocus.com/archive/1/201020 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0943 · Security Note
• http://securityfocus.com/bid/3129 · Vendor Advisory
• http://seclists.org/lists/bugtraq/2001/Dec/0001.html · Note
• http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0943 · Note