PT-2007-3462 · Oracle · Oracle Application Server+1

Alexander Kornbrust · Published 2007-04-18 · Updated 2018-10-16 · CVE-2007-2120

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Application Server versions 9.0.4.3, 10.1.2.0.2, 10.1.2.2.0

Description The issue allows remote attackers to shut down an Oracle TNS Listener via a TNS STOP command in a request. This can be achieved by using the database/TNS alias.

Recommendations For Oracle Application Server version 9.0.4.3, update to a version that includes a fix for this issue. For Oracle Application Server version 10.1.2.0.2, update to a version that includes a fix for this issue. For Oracle Application Server version 10.1.2.2.0, update to a version that includes a fix for this issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-2120

Affected Products

Oracle Application Server

Oracle Tns Listener

References · 11

• http://vupen.com/english/advisories/2007/1426 · Vendor Advisory
• http://securityfocus.com/archive/1/466329/100/200/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2120 · Security Note
• http://red-database-security.com/advisory/oracle_cpu_apr_2007.html · Note
• http://red-database-security.com/advisory/oracle_discoverer_servlet.html · Note
• http://securitytracker.com/id?1017927 · Note
• http://securityfocus.com/bid/23532 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2120 · Note
• http://securityfocus.com/archive/1/466160/100/0/threaded · Note
• http://us-cert.gov/cas/techalerts/TA07-108A.html · Note
• http://oracle.com/technetwork/topics/security/cpuapr2007-090632.html · Note