PT-2004-3139 · Oracle · Oracle Database Server+1

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2244

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle 9i Application Server Release 2 versions 9.0.2.3 and earlier, 9.0.3.0, 9.0.3.1 Oracle 9i Application Server Release 1 versions 1.0.2.2, 1.0.2.2.2 Oracle Database Server Release 2 version 9.2.0.1 and later

Description The issue allows remote attackers to cause a denial of service, consuming CPU and memory resources, by sending a crafted SOAP message containing a malicious DTD to the XML parser.

Recommendations For Oracle 9i Application Server Release 2 versions 9.0.2.3 and earlier, 9.0.3.0, 9.0.3.1, restrict access to the XML parser to minimize the risk of exploitation. For Oracle 9i Application Server Release 1 versions 1.0.2.2, 1.0.2.2.2, consider disabling the XML parser until a patch is available. For Oracle Database Server Release 2 version 9.2.0.1 and later, avoid processing SOAP messages with crafted DTDs in the XML parser until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-2244

Affected Products

Oracle 9I Application Server

Oracle Database Server

References · 7

• http://secunia.com/advisories/10936 · Vendor Advisory
• http://otn.oracle.com/deploy/security/pdf/2004alert65.pdf · Vendor Advisory
• http://securityfocus.com/bid/9703 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2244 · Security Note
• http://osvdb.org/4011 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2244 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15270 · Note