PT-2007-3452 · Oracle · Oracle Database

David Litchfield · Published 2007-04-18 · Updated 2018-10-16 · CVE-2007-2110

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database versions 9.0.1.5 and later, 9.2.0.7, 10.1.0.4

Description The issue concerns an unspecified vulnerability in the Core RDBMS component of Oracle Database. It is reported that this vulnerability may allow local users to inject threads and execute arbitrary code via the OpenProcess, OpenThread, and SetThreadContext functions. This is allegedly due to the RDBMS using a NULL Discretionary Access Control List (DACL) for the Oracle process and certain shared memory sections.

Recommendations For Oracle Database versions 9.0.1.5 and later, 9.2.0.7, 10.1.0.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2110

Affected Products

Oracle Database

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2007-2110 · Security Note
• http://vupen.com/english/advisories/2007/1426 · Vendor Advisory
• http://securityfocus.com/archive/1/466329/100/200/threaded · Vendor Advisory
• http://ngssoftware.com/research/papers/NGSSoftware-OracleCPUAPR2007.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2110 · Note
• http://red-database-security.com/advisory/oracle_cpu_apr_2007.html · Note
• http://freelists.org/archives/oracle-l/12-2006/msg00004.html · Note
• http://integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_April_2007_Analysis.pdf · Note
• http://securitytracker.com/id?1017927 · Note
• http://securityfocus.com/bid/23532 · Note
• https://blackhat.com/presentations/bh-dc-07/Cerrudo/Presentation/bh-dc-07-Cerrudo-ppt.pdf · Note
• http://us-cert.gov/cas/techalerts/TA07-108A.html · Note
• http://oracle.com/technetwork/topics/security/cpuapr2007-090632.html · Note