PT-2007-1745 · Oracle · Oracle Database

Alexander Kornbrust · Published 2007-01-17 · Updated 2017-07-29 · CVE-2007-0273

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3

Description The issue concerns an unspecified vulnerability related to XMLDB, potentially allowing for multiple cross-site scripting (XSS) attacks. The impact and attack vectors of this issue are unknown.

Recommendations For Oracle Database version 9.0.1.5, update to a version that addresses the XMLDB-related issue. For Oracle Database version 9.2.0.8, update to a version that addresses the XMLDB-related issue. For Oracle Database version 10.1.0.5, update to a version that addresses the XMLDB-related issue. For Oracle Database version 10.2.0.3, update to a version that addresses the XMLDB-related issue. As a temporary workaround, consider restricting access to XMLDB components to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0273

Affected Products

Oracle Database

References · 10

• http://us-cert.gov/cas/techalerts/TA07-017A.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-0273 · Security Note
• http://secunia.com/advisories/23794 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpujan2007-101493.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0273 · Note
• http://osvdb.org/32912 · Note
• http://securitytracker.com/id?1017522 · Note
• http://red-database-security.com/advisory/oracle_xmldb_css2.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31541 · Note
• http://securityfocus.com/bid/22083 · Note