PT-2005-3222 · Oracle · Oracle Forms

Alexander Kornbrust · Published 2005-07-17 · Updated 2017-07-11 · CVE-2005-2294

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Forms versions 4.5, 6.0, 6i, and 9i

Description: The issue allows local users to gain sensitive information, such as credit card numbers, when a large number of records are retrieved by an Oracle form. This occurs because the system stores a copy of the database tables in a world-readable temporary file.

Recommendations: For Oracle Forms versions 4.5, 6.0, 6i, and 9i, consider restricting access to the temporary files generated by the system to minimize the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2294

Affected Products

Oracle Forms

References · 6

• http://oracle.com/technology/deploy/security/pdf/cpujul2005.html · Vendor Advisory
• http://red-database-security.com/advisory/oracle_forms_unsecure_temp_file_handling.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2294 · Security Note
• http://secunia.com/advisories/15991 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=112129398711846&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21347 · Note