Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   Oracle Industry Applications Vendors:   Oracle
Oracle Communications Order and Service Management Bug Lets Remote Authenticated Users Access and Modify Data
SecurityTracker Alert ID:  1023060
SecurityTracker URL:
CVE Reference:   CVE-2009-1998   (Links to External Site)
Date:  Oct 20 2009
Impact:   Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.8.0, 6.2.0, 6.3.0, 6.3.1
Description:   A vulnerability was reported in Oracle Communications Order and Service Management. A remote authenticated user can access and modify some data on the target database.

No details were provided.

The following researchers reported these and other Oracle vulnerabilities:

Yaniv Azaria of Imperva, Inc.; Cesar Cerrudo of Argeniss; Deniz Cevik of Intellect; Joxean Koret; Joxean Koret of iSIGHT Partners Global Vulnerability Partnership; Alexander Kornbrust of Red Database Security; David Litchfield of NGS Software; Ryan Permeh of McAfee Avert labs; Guy Pilosof of Sentrigo; Aviv Pode of Sentrigo; Alexandr Polyakov of Digital Security; Pawel Romanek of Asseco Business Solutions; Amichai Shulman of Imperva, Inc.; Rajat Swarup; Laszlo Toth; Luka Treiber of ACROS Security; Wei Wang of McAfee Avert labs; and Dennis Yurichev.

Impact:   A remote authenticated user can access and modify some data on the target application.
Solution:   The vendor has issued a fix, described in their Oct 2009 Critical Patch Update advisory.

The Oracle advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Not specified

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC