PT-2004-2611 · Oracle · Oracle 8I+2

Published 2004-07-30 · Updated 2017-07-11 · CVE-2004-1707

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle 8i Oracle 9i Oracle IAS version 9.0.2.0.1

Description The issue concerns the dbsnmp and nmo programs in Oracle products on Unix systems. These programs use a default path to find and execute library files while operating at raised privileges. This allows certain Oracle user accounts to gain root privileges by modifying the libclntsh.so.9.0 library file.

Recommendations For Oracle 8i, update the configuration to use a secure path for library files. For Oracle 9i, modify the privileges of the affected Oracle user accounts to prevent them from executing the vulnerable library files. For Oracle IAS version 9.0.2.0.1, restrict access to the libclntsh.so.9.0 library file to prevent modification by unauthorized users.

Exploit

Fix

Related Identifiers

CVE-2004-1707

Affected Products

Oracle 8I

Oracle 9I

Oracle Ias

References · 7

• 🔥 https://exploit-db.com/exploits/24335 · Exploit
• 🔥 http://secunia.com/advisories/12205 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1707 · Security Note
• http://securityfocus.com/bid/10829 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109147677214087&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1707 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16839 · Note