SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Database)  >   Oracle Database Vendors:   Oracle
Oracle Database and Other Products Have 52 Unspecified Vulnerabilities With Unspecified Impact
SecurityTracker Alert ID:  1017522
SecurityTracker URL:  http://securitytracker.com/id/1017522
CVE Reference:   CVE-2007-0222   (Links to External Site)
Updated:  Jan 17 2007
Original Entry Date:  Jan 17 2007
Impact:   Disclosure of system information, Disclosure of user information, Not specified
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 8i, 9i, 10g
Description:   Over 50 vulnerabilities were reported in Oracle Database and other Oracle products. The impact was not specified by the vendor.

Oracle released their Critical Patch Update for January 2007, addressing numerous vulnerabilities in Oracle Database, Oracle Application Server, Oracle Enterprise Manager, Oracle Identity Management, PeopleSoft Enterprise PeopleTools, and Oracle Developer Suite product versions.

The following product versions are affected:

* Oracle Database 10g Release 2, versions 10.2.0.1, 10.2.0.2, 10.2.0.3
* Oracle Database 10g Release 1, versions 10.1.0.3, 10.1.0.4, 10.1.0.5
* Oracle9i Database Release 2, versions 9.2.0.5, 9.2.0.6, 9.2.0.7, 9.2.0.8
* Oracle9i Database Release 1, versions 9.0.1.4, 9.0.1.5, 9.0.1.5 FIPS
* Oracle8i Database Release 3, version 8.1.7.4
* Oracle Identity Management 10g, version 10.1.4.0.1
* Oracle Application Server 10g Release 3, versions 10.1.3.0.0, 10.1.3.1.0
* Oracle Application Server 10g Release 2, versions 10.1.2.0.0 - 10.1.2.0.2, 10.1.2.1.0, 10.1.2.2.0
* Oracle Application Server 10g, versions 9.0.4.1, 9.0.4.2, 9.0.4.3
* Oracle9i Application Server Release 2, version 9.0.2.3
* Oracle9i Application Server Release 1, version 1.0.2.2
* Oracle Enterprise Manager 10g Grid Control Release 2, version 10.2.0.1
* Oracle Enterprise Manager 10g Grid Control Release 1, versions 10.1.0.3, 10.1.0.4, 10.1.0.5
* Oracle E-Business Suite Release 11i, versions 11.5.7 - 11.5.10 CU2
* Oracle E-Business Suite Release 11.0
* Oracle PeopleSoft Enterprise PeopleTools versions 8.22, 8.47, 8.48
* Oracle Developer Suite, versions 6i, 9.0.4.3, 10.1.2.0.2

Oracle has provided no specifics regarding the nature of these vulnerabilities.

Oracle Database products contain 27 vulnerabilities, ten of which can be exploited by remote users without authentication. One vulnerability applies to Oracle Database client-only installations (that do not have the Oracle Database installed).

Oracle Application Server contains 12 vulnerabilities, eight of which can be exploited by remote users without authentication.

A directory traversal vulnerability resides in the EmChartBean component of the application server [CVE-2007-0222]. A remote user can supply a specially crafted GET request to view files located outside of the target application's root directory. On Windows-based systems, files can be viewed with LocalSystem privileges. Oliver Karow from Symantec reported this vulnerability.

Oracle Collaboration Suite itself is not vulnerable. However, Application Server components containing 14 vulnerabilities are included with Collaboration Suite, ten of which can be exploited by remote users without authentication.

Oracle E-Business Suite contains seven vulnerabilities which can be exploited by remote authenticated users. In addition, Application Server components containing six vulnerabilities that can be exploited by remote users are included with EBusiness Suite.

Oracle PeopleSoft Enterprise contains three vulnerabilities, one which can be exploited by remote users without authentication.

Oracle Enterprise Portal Solutions and JD Edwards EnterpriseOne are not vulnerable.

Oracle has provided the following maximum CVSS base scores:

* Oracle Database: 7.0
* Oracle Application Server: 4.7
* Oracle E-Business Suite: 7.0
* Oracle Enterprise Manager: 7.0
* Oracle PeopleSoft Enterprise: 2.3

Oracle credits the following individuals and organizations with reporting these vulnerabilities:

Andy Davis of Information Risk Management Plc; Vicente Aguilera Diaz of Internet Security Auditors, S.L.; Esteban Martinez Fayo of Application Security, Inc.; Tony Fogarty of BT Global Services; Oliver Karow of Symantec; Joxean Koret; Alexander Kornbrust of Red Database Security GmbH; David Litchfield and Mark Litchfield of Next Generation Security Software Ltd.; and noderat ratty.

Impact:   A remote user can view files located outside of the target application's root directory.

The impact was not specified for the other vulnerabilities.

Solution:   The vendor has issued a fix, described in their January 2007 Critical Patch Update advisory at:

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

Vendor URL:  www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html (Links to External Site)
Cause:   Access control error, Not specified
Underlying OS:   Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000)

Message History:   None.


 Source Message Contents

Date:  Tue, 16 Jan 2007 14:27:49 -0500
Subject:  Oracle Database


http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC