PT-2009-3563 · Oracle · Oracle Database

Alexander Kornbrust · Published 2009-04-15 · Updated 2018-10-10 · CVE-2009-0981

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database version 11.1.0.7

Description The issue affects confidentiality and is related to the APEX component in Oracle Database. It allows remote authenticated users to potentially obtain APEX password hashes from the WWV FLOW USERS table via a SELECT statement.

Recommendations For Oracle Database version 11.1.0.7, consider restricting access to the WWV FLOW USERS table as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2009-0981

Affected Products

Oracle Database

References · 11

• 🔥 https://exploit-db.com/exploits/8456 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0981 · Security Note
• http://securityfocus.com/archive/1/502724/100/0/threaded · Note
• http://red-database-security.com/advisory/apex_password_hashes.html · Note
• http://securityfocus.com/bid/34461 · Note
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Note
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0981 · Note
• http://secunia.com/advisories/34693 · Note
• http://securitytracker.com/id?1022052 · Note
• http://osvdb.org/53738 · Note