PT-2007-5084 · Oracle · Oracle Database

Published 2007-07-18 · Updated 2017-07-29 · CVE-2007-3853

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 10.1.0.5 through 10.2.0.3

Description: The issue involves multiple unspecified vulnerabilities that allow remote authenticated users to have an unknown impact. The vulnerabilities are located in the following components: (1) JavaVM via DBMS JAVA TEST, (2) Oracle Text, and (3) Spatial via MDSYS.SDO GEOR INT. A researcher claims that one of the vulnerabilities, DB01, is related to SQL injection in DBMS PRVTAQIS.

Recommendations: For Oracle Database versions 10.1.0.5 through 10.2.0.3, consider restricting access to the vulnerable components, such as disabling the DBMS JAVA TEST function in the JavaVM component, limiting access to the Oracle Text component, and restricting the use of MDSYS.SDO GEOR INT in the Spatial component, until a fix is available. Additionally, as a temporary workaround, consider implementing measures to prevent SQL injection attacks, such as input validation and sanitization, for the DBMS PRVTAQIS function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-3853

Affected Products

Oracle Database

References · 15

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3853 · Security Note
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA07-200A.html · Note
• http://vupen.com/english/advisories/2007/2635 · Note
• http://integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf · Note
• http://oracle.com/technetwork/topics/security/cpujul2007-087014.html · Note
• http://red-database-security.com/advisory/oracle_cpu_jul_2007.html · Note
• http://securityfocus.com/archive/1/474000 · Note
• http://vupen.com/english/advisories/2007/2562 · Note
• http://secunia.com/advisories/26114 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35490 · Note
• http://secunia.com/advisories/26166 · Note
• http://securitytracker.com/id?1018415 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3853 · Note