PT-2005-3285 · Oracle · Oracle Reports

Alexander Kornbrust · Published 2005-07-26 · Updated 2018-10-19 · CVE-2005-2371

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Reports versions 6.0, 6i, 9i, 10g

Description A directory traversal issue allows remote attackers to overwrite arbitrary files by manipulating the desname parameter with sequences such as "..", Windows drive letters (e.g., "C:"), or absolute paths.

Recommendations For Oracle Reports versions 6.0, 6i, 9i, 10g, consider applying the fix provided in CPU Jan 2006, which likely addresses this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2005-2371

Affected Products

Oracle Reports

References · 11

• http://secunia.com/advisories/18608 · Vendor Advisory
• http://red-database-security.com/advisory/oracle_reports_overwrite_any_file.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2371 · Security Note
• http://vupen.com/english/advisories/2006/0323 · Vendor Advisory
• http://secunia.com/advisories/18493 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=112180096507467&w=2 · Note
• http://securitytracker.com/id?1014524 · Note
• http://securityfocus.com/bid/14309 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24321 · Note
• http://securityfocus.com/archive/1/422257/30/7430/threaded · Note
• http://oracle.com/technetwork/topics/security/cpujan2006-082403.html · Note