PT-2006-6079 · Oracle · Oracle E-Business Suite/Applications+2

Alexander Kornbrust · Published 2006-10-18 · Updated 2018-10-17 · CVE-2006-5359

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Application Server versions 9.0.4.3 and 10.1.2.0.2 Oracle E-Business Suite and Applications version 11.5.10CU2

Description The issue concerns multiple unspecified vulnerabilities in the Oracle Reports Developer component. These vulnerabilities have unknown impact and can be exploited remotely. The vulnerabilities are reportedly related to showenv and parsequery for one issue, and cellwrapper and delimiter for another.

Recommendations For Oracle Application Server versions 9.0.4.3 and 10.1.2.0.2, consider restricting access to the Oracle Reports Developer component until a fix is available. For Oracle E-Business Suite and Applications version 11.5.10CU2, avoid using the showenv and parsequery functions, as well as the cellwrapper and delimiter functions, in the Oracle Reports Developer component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5359

Affected Products

Oracle Application Server

Oracle E-Business Suite/Applications

Oracle Reports Developer

References · 12

• http://vupen.com/english/advisories/2006/4065 · Vendor Advisory
• http://secunia.com/advisories/22396 · Vendor Advisory
• http://securityfocus.com/archive/1/449711/100/0/threaded · Vendor Advisory
• http://securityfocus.com/bid/20588 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5359 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5359 · Note
• http://us-cert.gov/cas/techalerts/TA06-291A.html · Note
• http://securityfocus.com/archive/1/449503/100/0/threaded · Note
• http://securitytracker.com/id?1017077 · Note
• http://red-database-security.com/advisory/oracle_cpu_oct_2006.html · Note
• http://red-database-security.com/advisory/oracle_reports_css.html · Note
• http://oracle.com/technetwork/topics/security/cpuoct2006-095368.html · Note