Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Oracle Database and Other Products Have Unspecified Vulnerabilities With Unspecified Impact
|
|
SecurityTracker Alert ID: 1019855
|
|
SecurityTracker URL: http://securitytracker.com/id?1019855
|
|
CVE Reference: CVE-2008-1811
, CVE-2008-1812
, CVE-2008-1813
, CVE-2008-1814
, CVE-2008-1815
, CVE-2008-1816
, CVE-2008-1817
, CVE-2008-1818
, CVE-2008-1819
, CVE-2008-1820
, CVE-2008-1821
, CVE-2008-1822
, CVE-2008-1823
, CVE-2008-1824
, CVE-2008-1825
, CVE-2008-1826
, CVE-2008-1827
, CVE-2008-1828
, CVE-2008-1829
, CVE-2008-1830
, CVE-2008-1831
(Links to External Site)
|
Date: Apr 16 2008
|
Impact: Not specified
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Oracle Security Advisory
|
Description: Numerous vulnerabilities were reported in Oracle Database and other Oracle products. The impact was not specified by the vendor.
Oracle released their Critical Patch Update for April 2008, addressing numerous vulnerabilities in Oracle Database, Oracle Application
Server, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle PeopleSoft Enterprise PeopleTools and HCM versions, and Oracle
Siebel SimBuilder.
The following product versions are affected:
* Oracle Database 11g, version 11.1.0.6
* Oracle Database
10g Release 2, versions 10.2.0.2, 10.2.0.3
* Oracle Database 10g, versions 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8,
9.2.0.8DV
* Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.1.0, 10.1.3.3.0
* Oracle Application Server 10g
Release 2 (10.1.2), versions 10.1.2.0.2, 10.1.2.1.0, 10.1.2.2.0
* Oracle Application Server 10g (9.0.4), version 9.0.4.3
* Oracle
E-Business Suite Release 12, version 12.0.4
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* Oracle PeopleSoft Enterprise
PeopleTools versions 8.22.19, 8.48.16, 8.49.09
* Oracle PeopleSoft Enterprise HCM versions 8.8 SP1, 8.9, 9.0
* Oracle Siebel SimBuilder
versions 7.8.2, 7.8.5
* Oracle Database 9i, version 9.0.1.5 FIPS+
* Oracle Application Server 9i Release 1, version 1.0.2.2
Oracle
has provided no specifics regarding the nature of these vulnerabilities.
Oracle Database products contain 15 vulnerabilities,
one of which can be exploited by remote users without authentication. None of the vulnerabilities apply to Oracle Database client-only
installations (that do not have the Oracle Database installed).
The affected Database components include: Oracle Enterprise Manager,
Change Data Capture, Oracle Spatial, Core RDBMS, Authentication, Data Pump, Export, Audit, Query Optimizer, Advance Queuing, and
Oracle Secure Enterprise Search or Ultrasearch.
Oracle Application Server contains three vulnerabilities that can be exploited
by remote users without authenticating. One of the vulnerabilities applies to Oracle Application Server client-only installations
(that do not have the Oracle Application Server installed).
Oracle E-Business Suite contains 11 vulnerabilities, seven of which
can be exploited by remote users without authenticating.
Oracle Enterprise Manager contains one vulnerability.
Oracle PeopleSoft
Enterprise PeopleTools contains three vulnerabilities.
Oracle has provided the following maximum CVSS base scores:
* Oracle
Database: 6.6
* Oracle Application Server: 9.3
* Oracle E-Business Suite: 5.0
* Oracle Enterprise Manager: 6.6
* Oracle PeopleSoft
Enterprise: 4.0
Oracle credits the following individuals and organizations with reporting these vulnerabilities:
Cesar Cerrudo
of Argeniss; Esteban Martinez Fayo of Application Security, Inc.; Joxean Koret working with iDefense VCP; Alexander Kornbrust of
Red Database Security; Stephen Kost of Integrigy; Ali Kumcu of inTellectPro; Amichai Shulman of Imperva, Inc., Sumit Siddharth of
Portcullis Computer Security Limited and Paul M. Wright, formerly of NGS Software.
|
Impact: The impact was not specified.
|
Solution: The vendor has issued a fix, described in their April 2008 Critical Patch Update advisory.
The Oracle advisory is available at:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2008.html
|
Vendor URL: www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2008.html (Links to External Site)
|
Cause: Not specified
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 16 Apr 2008 08:16:43 -0400
Subject: Oracle Database
|
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2008.html
CVE-2008-1811
CVE-2008-1812
CVE-2008-1813
CVE-2008-1814
CVE-2008-1815
CVE-2008-1816
CVE-2008-1817
CVE-2008-1818
CVE-2008-1819
CVE-2008-1820
CVE-2008-1821
CVE-2008-1822
CVE-2008-1823
CVE-2008-1824
CVE-2008-1825
CVE-2008-1826
CVE-2008-1827
CVE-2008-1828
CVE-2008-1829
CVE-2008-1830
CVE-2008-1831
|
|
Go to the Top of This SecurityTracker Archive Page
|
