PT-2016-5125 · Allround Automations · Pl/Sql Developer

Adam Caudill · Published 2016-04-25 · Updated 2016-05-04 · CVE-2016-2346

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allround Automations PL/SQL Developer version 11.0.6 and earlier, specifically versions prior to 11.0.6

Description The issue allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream, as the software relies on unverified HTTP data for updates.

Recommendations For versions prior to 11.0.6, update to version 11.0.6 or later to resolve the issue.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2016-2346

Affected Products

Pl/Sql Developer

References · 4

• 🔥 https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption · Exploit
• https://osv.dev/vulnerability/CVE-2016-2346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2346 · Security Note
• http://kb.cert.org/vuls/id/229047 · Note