PT-2007-6537 · Oracle · Oracle Database

Published 2007-10-17 · Updated 2018-10-15 · CVE-2007-5513

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 9.2.0.8 through 9.2.0.8DV Oracle Database version 10.1.0.5

Description: The issue affects the XML DB component, causing it to generate incorrect audit entries in the USERID column. This occurs in two scenarios: when long usernames are trimmed to 5 characters, or when short entries contain extra characters from usernames in previous entries.

Recommendations: For Oracle Database versions 9.2.0.8 through 9.2.0.8DV, consider updating the XML DB component to prevent incorrect audit entries. For Oracle Database version 10.1.0.5, consider updating the XML DB component to prevent incorrect audit entries. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-5513

Affected Products

Oracle Database

References · 14

• http://marc.info/?l=bugtraq&m=119332677525918&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5513 · Security Note
• http://secunia.com/advisories/27251 · Vendor Advisory
• http://securityfocus.com/bid/26107 · Note
• http://securityfocus.com/archive/1/482426/100/0/threaded · Note
• http://securitytracker.com/id?1018823 · Note
• http://ngssoftware.com/advisories/high-risk-vulnerability-in-oracle-xmldb-ftp-service · Note
• http://us-cert.gov/cas/techalerts/TA07-290A.html · Note
• http://oracle.com/technetwork/topics/security/cpuoct2007-092913.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5513 · Note
• http://securityreason.com/securityalert/3247 · Note
• http://vupen.com/english/advisories/2007/3524 · Note
• http://vupen.com/english/advisories/2007/3626 · Note
• http://secunia.com/advisories/27409 · Note