PT-2007-5647 · Oracle · Oracle Jinitiator Activex Control

Published 2007-08-31 · Updated 2018-10-15 · CVE-2007-4467

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle JInitiator ActiveX control (beans.ocx) versions 1.1.8.3 through 1.1.8.25 Oracle JInitiator ActiveX control (beans.ocx) versions 1.1.5.x and earlier Oracle JInitiator ActiveX control (beans.ocx) versions 1.1.7.x and earlier

Description The issue allows remote attackers to execute arbitrary code via unspecified initialization parameters, which can lead to multiple stack-based buffer overflows in the Oracle JInitiator ActiveX control.

Recommendations For versions 1.1.8.3 through 1.1.8.25, consider updating to a version later than 1.1.8.25 to resolve the issue. For versions 1.1.5.x and earlier, consider updating to a version later than 1.1.5.x to resolve the issue. For versions 1.1.7.x and earlier, consider updating to a version later than 1.1.7.x to resolve the issue. As a temporary workaround, consider restricting the use of initialization parameters in the Oracle JInitiator ActiveX control until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-4467

Affected Products

Oracle Jinitiator Activex Control

References · 10

• http://secunia.com/advisories/26644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4467 · Security Note
• http://vupen.com/english/advisories/2007/3007 · Vendor Advisory
• http://securityfocus.com/archive/1/479186/100/100/threaded · Note
• http://kb.cert.org/vuls/id/474433 · Note
• http://securityfocus.com/bid/25473 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36310 · Note
• http://securitytracker.com/id?1018618 · Note
• http://osvdb.org/37711 · Note
• http://integrigy.com/security-resources/analysis/integrigy-oracle-jinitiator-vulnerability.pdf · Note