PT-2001-2187 · Oracle · Oracle

Published 2001-08-31 · Updated 2016-10-18 · CVE-2001-1041

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle versions 8.0.x through 9.0.1

Description The issue allows local users to overwrite arbitrary files via a symlink attack on an Oracle log trace (.trc) file. This is made possible by the program creating the log file in an alternate home directory identified by the ORACLE HOME environment variable.

Recommendations For Oracle versions 8.0.x through 9.0.1, consider restricting access to the ORACLE HOME environment variable to minimize the risk of exploitation. As a temporary workaround, avoid using the Oracle log trace (.trc) file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1041

Affected Products

Oracle

References · 6

• http://securityfocus.com/bid/3135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1041 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1041 · Note
• http://marc.info/?l=bugtraq&m=99677282117387&w=2 · Note
• http://marc.info/?l=bugtraq&m=100395579811880&w=2 · Note
• http://otn.oracle.com/deploy/security/pdf/oracle_race.pdf · Note