PT-2009-3575 · Oracle · Oracle Application Server

Joxean Koret · Published 2009-04-15 · Updated 2021-07-13 · CVE-2009-0993

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Application Server version 10.1.2.3

Description The issue affects confidentiality, integrity, and availability. It is reportedly related to the handling of HTTP POST requests, potentially allowing remote attackers to execute arbitrary code via format string specifiers in the URI, which are not properly handled when logging to opmn/logs/opmn.log.

Recommendations For Oracle Application Server version 10.1.2.3, consider restricting access to the OPMN component until a fix is available. As a temporary workaround, avoid using format string specifiers in HTTP POST URIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2009-0993

Affected Products

Oracle Application Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2009-0993 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50030 · Note
• http://securityfocus.com/bid/34461 · Note
• http://us-cert.gov/cas/techalerts/TA09-105A.html · Note
• http://oracle.com/technetwork/topics/security/cpuapr2009-099563.html · Note
• http://securitytracker.com/id?1022055 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-017 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0993 · Note
• http://secunia.com/advisories/34693 · Note
• http://securityfocus.com/archive/1/502683/100/0/threaded · Note