PT-2009-4434 · Oracle · Oracle Database

Published 2009-10-22 · Updated 2018-10-10 · CVE-2009-1979

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 10.1.0.5 through 10.2.0.4

Description: The issue affects the confidentiality, integrity, and availability of the system. It is related to the Network Authentication component. Details about real-world incidents where this issue was exploited are not provided. An independent researcher claims that the issue might be related to improper validation of the AUTH SESSKEY parameter length, potentially leading to arbitrary code execution.

Recommendations: For Oracle Database versions 10.1.0.5 through 10.2.0.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2009-1979

Affected Products

Oracle Database

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/oracle/tns_auth_sesskey.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16342 · Exploit
• 🔥 https://exploit-db.com/exploits/9905 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1979 · Security Note
• http://osvdb.org/59110 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1979 · Note
• http://securitytracker.com/id?1023057 · Note
• http://oracle.com/technetwork/topics/security/cpuoct2009-096303.html · Note
• http://blogs.conus.info/node/28 · Note
• http://securityfocus.com/archive/1/507598/100/0/threaded · Note
• http://securityfocus.com/bid/36747 · Note
• http://us-cert.gov/cas/techalerts/TA09-294A.html · Note
• http://secunia.com/advisories/37027 · Note