PT-2007-5085 · Oracle · Oracle Database

Published 2007-07-18 · Updated 2017-07-29 · CVE-2007-3854

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 9.0.1.5 and later, 9.2.0.7, 10.1.0.5

Description: The issue affects the Oracle Database due to unspecified vulnerabilities in the Advanced Queuing and Spatial components. These vulnerabilities can be exploited by remote authenticated users and may allow for SQL injection via SYS.DBMS PRVTAQIS and a buffer overflow via MDSYS.MD.

Recommendations: For Oracle Database version 9.0.1.5 and later, consider restricting access to the SYS.DBMS PRVTAQIS and MDSYS.MD components until a patch is available. For Oracle Database version 9.2.0.7, restrict access to the SYS.DBMS PRVTAQIS and MDSYS.MD components until a patch is available. For Oracle Database version 10.1.0.5, restrict access to the SYS.DBMS PRVTAQIS and MDSYS.MD components until a patch is available.

Fix

Related Identifiers

CVE-2007-3854

Affected Products

Oracle Database

References · 15

• http://vupen.com/english/advisories/2007/2635 · Vendor Advisory
• http://vupen.com/english/advisories/2007/2562 · Vendor Advisory
• http://secunia.com/advisories/26114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3854 · Security Note
• http://secunia.com/advisories/26166 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 · Vendor Advisory
• http://red-database-security.com/advisory/oracle_sql_injection_dbms_prvtaqis.html · Note
• http://oracle.com/technetwork/topics/security/cpujul2007-087014.html · Note
• http://integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf · Note
• http://red-database-security.com/advisory/oracle_cpu_jul_2007.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35497 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3854 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35490 · Note
• http://us-cert.gov/cas/techalerts/TA07-200A.html · Note
• http://securitytracker.com/id?1018415 · Note