PT-2009-1268 · Oracle · Oracle Database

Joxean Koret · Published 2009-01-14 · Updated 2018-10-11 · CVE-2008-5440

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database version 7.0.5.0.0

Description The issue affects confidentiality, integrity, and availability. It is reportedly related to the msg parameter in the evtdump CGI module, potentially a format string vulnerability.

Recommendations For Oracle Database version 7.0.5.0.0, consider restricting access to the evtdump CGI module until a fix is available. Avoid using the msg parameter in the affected module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2008-5440

Affected Products

Oracle Database

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-5440 · Security Note
• http://vupen.com/english/advisories/2009/0115 · Vendor Advisory
• http://secunia.com/advisories/33525 · Vendor Advisory
• http://joxeankoret.com/blog/?p=41 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-004 · Note
• http://securityfocus.com/bid/33177 · Note
• http://securityfocus.com/archive/1/500080/100/0/threaded · Note
• http://securityfocus.com/archive/1/500078/100/0/threaded · Note
• http://oracle.com/technetwork/topics/security/cpujan2009-097901.html · Note