PT-2008-1980 · Oracle · Oracle Application Server+3

Published 2008-01-17 · Updated 2018-10-15 · CVE-2008-0347

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Collaboration Suite version 10.1.2 Oracle Database versions 9.2.0.8, 10.1.0.5, and 10.2.0.3 Oracle Application Server versions 9.0.4.3 and 10.1.2.0.2

Description The issue concerns an unspecified vulnerability in the Oracle Ultra Search component, with unknown impact and local attack vectors. It is reportedly related to WKSYS schema privileges.

Recommendations For Oracle Collaboration Suite version 10.1.2, update to a version that addresses the issue related to WKSYS schema privileges. For Oracle Database versions 9.2.0.8, 10.1.0.5, and 10.2.0.3, restrict access to the WKSYS schema to minimize potential impact. For Oracle Application Server versions 9.0.4.3 and 10.1.2.0.2, consider limiting privileges related to the Ultra Search component until a fix is available.

Fix

Related Identifiers

CVE-2008-0347

Affected Products

Oracle Application Server

Oracle Collaboration Suite

Oracle Database

Oracle Ultra Search

References · 13

• http://secunia.com/advisories/28518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0347 · Security Note
• http://secunia.com/advisories/28556 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0150 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0180 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=120058413923005&w=2 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA08-017A.html · Note
• http://petefinnigan.com/Advisory_CPU_Jan_2008.htm · Note
• http://securityfocus.com/bid/27229 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0347 · Note
• http://oracle.com/technetwork/topics/security/cpujan2008-086860.html · Note
• http://securityfocus.com/archive/1/487322/100/100/threaded · Note
• http://securitytracker.com/id?1019218 · Note