PT-2005-1376 · Oracle · Oracle

Pete Finnigan · Published 2005-02-10 · Updated 2017-07-11 · CVE-2005-0298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle versions 8i through 10g

Description The issue concerns the DIRECTORY objects in the affected Oracle versions, which store the location of a specific operating system directory. This allows users with read privileges to a DIRECTORY object to access sensitive information.

Recommendations For Oracle versions 8i through 10g, restrict read access to DIRECTORY objects to prevent unauthorized users from obtaining sensitive information. Consider revoking read privileges from users who do not require them.

Fix

Related Identifiers

CVE-2005-0298

Affected Products

Oracle

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0298 · Security Note
• http://oracle.com/technology/deploy/security/pdf/cpu-jan-2005_advisory.pdf · Patch
• http://petefinnigan.com/directory_traversal.pdf · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0298 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18947 · Note
• http://marc.info/?l=bugtraq&m=110608912525883&w=2 · Note