PT-2010-3974 · Oracle · Oracle Database Server+2

Published 2010-10-13 · Updated 2010-11-11 · CVE-2010-2390

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.1.0.5 through 10.1.0.5 Oracle Database Server versions 10.2.0.3 through 10.2.0.3 Oracle Fusion Middleware versions 10.1.2.3 through 10.1.2.3 Oracle Fusion Middleware versions 10.1.4.3 through 10.1.4.3 Enterprise Manager Grid Control (affected versions not specified)

Description The issue affects the Database Control component in EM Console, allowing remote attackers to impact confidentiality, integrity, and availability. The vectors used for the attack are unknown.

Recommendations For Oracle Database Server version 10.1.0.5, update to a version that includes the fix for this issue. For Oracle Database Server version 10.2.0.3, update to a version that includes the fix for this issue. For Oracle Fusion Middleware version 10.1.2.3, update to a version that includes the fix for this issue. For Oracle Fusion Middleware version 10.1.4.3, update to a version that includes the fix for this issue. For Enterprise Manager Grid Control, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2010-2390

Affected Products

Enterprise Manager Grid Control

Oracle Database Server

Oracle Fusion Middleware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-2390 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-287A.html · Note
• http://oracle.com/technetwork/topics/security/cpuoct2010-175626.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2390 · Note