PT-2003-2145 · Oracle · Oracle9I Application Server

Published 2003-11-03 · Updated 2017-07-11 · CVE-2003-1193

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Oracle9i Application Server versions 9.0.2.00 through 3.0.9.8.5

Description The issue concerns multiple SQL injection vulnerabilities in various components of Oracle Oracle9i Application Server, including the Portal DB's List of Values (LOVs), Forms, Hierarchy, and XML components packages. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the URL.

Recommendations For Oracle Oracle9i Application Server versions 9.0.2.00 through 3.0.9.8.5, update to a version that includes the necessary security patches to fix the SQL injection vulnerabilities in the affected components.

Fix

Related Identifiers

CVE-2003-1193

Affected Products

Oracle9I Application Server

References · 5

• http://otn.oracle.com/deploy/security/pdf/2003alert61.pdf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1193 · Security Note
• http://securityfocus.com/archive/1/343520 · Vendor Advisory
• http://securityfocus.com/bid/8966 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13593 · Note