PT-2007-5097 · Oracle · Oracle Configurator+4

Published 2007-07-18 · Updated 2018-10-15 · CVE-2007-3866

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 11.5.10CU2 through 12.0.1

Description: The issue affects Oracle E-Business Suite, allowing remote attackers to have an unknown impact. This is achieved through various components, including Oracle Configurator, Oracle iExpenses, Oracle Application Object Library, and specific modules in Oracle Payables.

Recommendations: For Oracle E-Business Suite version 11.5.10CU2, update to a version that addresses the issue. For Oracle E-Business Suite version 12.0.1, apply the necessary patches or updates to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable components, such as Oracle Configurator, Oracle iExpenses, and Oracle Application Object Library, until a patch is available.

Fix

Related Identifiers

CVE-2007-3866

Affected Products

Oracle Application Object Library

Oracle Configurator

Oracle E-Business Suite

Oracle Payables

Oracle Iexpenses

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2007-3866 · Security Note
• http://secunia.com/advisories/26114 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA07-200A.html · Note
• http://vupen.com/english/advisories/2007/2635 · Note
• http://integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf · Note
• http://oracle.com/technetwork/topics/security/cpujul2007-087014.html · Note
• http://red-database-security.com/advisory/oracle_cpu_jul_2007.html · Note
• http://vupen.com/english/advisories/2007/2562 · Note
• http://securityfocus.com/archive/1/474515/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35490 · Note
• http://secunia.com/advisories/26166 · Note
• http://securitytracker.com/id?1018415 · Note