PT-2008-4061 · Oracle · Oracle Database
Published
2008-07-15
·
Updated
2012-10-23
·
CVE-2008-2607
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle Database versions 9.2.0.8 through 9.2.0.8DV
Oracle Database versions 10.1.0.5
Oracle Database versions 10.2.0.4
Oracle Database versions 11.1.0.6
Description
The issue is related to the Advanced Queuing component, specifically
SYS.DBMS AQELM, and has remote authenticated attack vectors. Researchers claim it may be a buffer overflow, potentially allowing attackers to cause a denial of service (database corruption) and possibly execute arbitrary code via a long argument to an unspecified procedure.Recommendations
For Oracle Database version 9.2.0.8, update to a version that is not affected by this issue.
For Oracle Database version 9.2.0.8DV, update to a version that is not affected by this issue.
For Oracle Database version 10.1.0.5, update to a version that is not affected by this issue.
For Oracle Database version 10.2.0.4, update to a version that is not affected by this issue.
For Oracle Database version 11.1.0.6, update to a version that is not affected by this issue.
As a temporary workaround, consider restricting access to the
SYS.DBMS AQELM component until a patch is available.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Oracle Database