SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Oracle Fusion Middleware Vendors:   Oracle
Oracle Fusion Middleware Flaws Let Remote Users Partially Modify Data and Local Users Partially Deny Service
SecurityTracker Alert ID:  1025397
SecurityTracker URL:  http://securitytracker.com/id/1025397
CVE Reference:   CVE-2011-0789, CVE-2011-0794, CVE-2011-0795, CVE-2011-0798, CVE-2011-0808   (Links to External Site)
Date:  Apr 19 2011
Impact:   Denial of service via local system, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 8.3.2.0, 8.3.5.0, 10.1.2.3, 11.1.1.2.0; and prior versions
Description:   Multiple vulnerabilities were reported in Oracle Fusion Middleware. A remote user can partially modify data on the target system. A local user can cause partial denial of service conditions on the target system.

The Oracle HTTP Server [CVE-2011-0789], Oracle Outside In Technology [CVE-2011-0794, CVE-2011-0808], Single Sign On [CVE-2011-0795], and Portal [CVE-2011-0798] components are affected.

The following researchers reported these and other Oracle vulnerabilities:

Alexander Kornbrust of Red Database Security; Alexandr Polyakov of Digital Security; Ariel Elias-Bachrach of Navy Federal Credit Union; babi working with Beyond Security's SecuriTeam Secure Disclosure program; Bryan Horstmann-Allen; Dan Rosenberg of Virtual Security Research; David Vaartjes of ITsec Security Services; Dmitri Gribenko; Esteban Martinez Fayo of Application Security, Inc.; Jason Bowes of TippingPoint's Zero Day Initiative; Joris Knape of Seneca Risk & Security BV; Juan Manuel Garcia of CYBSEC S.A.; Juan Pablo Perez Etchegoyen of Onapsis; Marc Schoenefeld of Red Hat; Mark Cranness of Clarus Limited; Mike Bailey of MAD Security; Nahuel Grisolia formerly of CYBSEC S.A.; Oleg P. of HSC Security Portal; Stijn Handgraaf of ITsec Security Services; Sumit Siddharth from 7safe; Tony Fogarty formerly of DNV; Vicente Aguilera Diaz of Internet Security Auditors, S.L.; Wietse Venema; and Will Dormann of CERT/CC.

Impact:   A remote user can partially modify data on the target system.

A local user can cause partial denial of service conditions on the target system.

Solution:   The vendor has issued a fix, described in their April 2011 Critical Patch Update advisory.

The vendor's advisory is available at:

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

Vendor URL:  www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html (Links to External Site)
Cause:   Not specified
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Oct 26 2011 (Cisco Issues Fix for Cisco Security Agent) Oracle Fusion Middleware Flaws Let Remote Users Partially Modify Data and Local Users Partially Deny Service
Cisco has issued a fix for Cisco Security Agent.
Jan 25 2012 (IBM Issues Fix for DB2) Oracle Fusion Middleware Flaws Let Remote Users Partially Modify Data and Local Users Partially Deny Service
IBM has issued a fix for IBM DB2.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC