PT-2007-3456 · Oracle · Oracle Database+1
Published
2007-04-18
·
Updated
2018-10-16
·
CVE-2007-2114
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Oracle Database versions 10.1.0.5 through 10.2.0.2
Description
The issue is related to multiple unspecified vulnerabilities in Oracle Database, with remote authenticated attack vectors. These vulnerabilities are associated with (1) Change Data Capture (CDC), aka DB08, and (2) Oracle Instant Client, aka DB11. It is reported that these issues may be buffer overflows, potentially caused by using a long
CHANGE TABLE NAME parameter to the DBMS CDC IPUBLISH.CHGTAB CACHE procedure and the Oracle Instant Client genezi utility.Recommendations
For Oracle Database versions 10.1.0.5 through 10.2.0.2, consider restricting access to the
DBMS CDC IPUBLISH.CHGTAB CACHE procedure and the Oracle Instant Client genezi utility to minimize the risk of exploitation. Avoid using a long CHANGE TABLE NAME parameter in the DBMS CDC IPUBLISH.CHGTAB CACHE procedure until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Oracle Database
Oracle Instant Client