PT-2007-1742 · Oracle · Oracle Database

Published 2007-01-17 · Updated 2018-10-16 · CVE-2007-0270

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.2.0.7 and 10.1.0.4

Description The issue is related to a buffer overflow in SYS.DBMS DRS, which can be exploited by remote authenticated users. This can lead to a denial of service (crash) or the execution of arbitrary code via the GET PROPERTY function in SYS.DBMS DRS.

Recommendations For Oracle Database version 9.2.0.7, consider disabling the GET PROPERTY function in SYS.DBMS DRS as a temporary workaround until a patch is available. For Oracle Database version 10.1.0.4, consider disabling the GET PROPERTY function in SYS.DBMS DRS as a temporary workaround until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-0270

Affected Products

Oracle Database

References · 12

• http://us-cert.gov/cas/techalerts/TA07-017A.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-0270 · Security Note
• http://secunia.com/advisories/23794 · Vendor Advisory
• http://securityfocus.com/archive/1/474050/100/0/threaded · Note
• http://oracle.com/technetwork/topics/security/cpujan2007-101493.html · Note
• http://osvdb.org/32909 · Note
• http://securityfocus.com/archive/1/458036/100/0/threaded · Note
• http://securitytracker.com/id?1017522 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31541 · Note
• http://securityfocus.com/bid/22083 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0270 · Note
• http://appsecinc.com/resources/alerts/oracle/2007-04.shtml · Note