Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Oracle Database Flaws Let Remote Users Take Fully Control of the Database or System
|
|
SecurityTracker Alert ID: 1023436 |
|
SecurityTracker URL: http://securitytracker.com/id/1023436
|
|
CVE Reference:
CVE-2009-1996, CVE-2009-3410, CVE-2009-3411, CVE-2009-3412, CVE-2009-3413, CVE-2009-3414, CVE-2009-3415, CVE-2010-0071, CVE-2010-0076
(Links to External Site)
|
Date: Jan 12 2010
|
Impact:
Denial of service via network, Disclosure of user information, Modification of user information, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 9.2.0.8, 10.1.0.5, 10.2.0.3, 10.2.0.4, 11.1.0.7; and prior versions
|
Description:
Several vulnerabilities were reported in Oracle Database. A remote user can take full control of the target system.
A remote user can exploit an unspecified flaw in the Listener to take full control of the target system.
Additional vulnerabilities let remote authenticated users access or modify data on the target database or cause denial of service conditions.
No additional details were provided.
The following versions are affected:
Oracle Database 11g, version 11.1.0.7
Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4
Oracle Database 10g, version 10.1.0.5
Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
The Listener [CVE-2010-0071], Oracle OLAP [CVE-2009-3415], Application Express Application Builder [CVE-2010-0076], Oracle Data Pump [CVE-2009-3411], Oracle Spatial [CVE-2009-3413, CVE-2009-3414 ], Logical Standby [CVE-2009-1996], RDBMS [CVE-2009-3410], and Unzip [CVE-2009-3412] components are affected.
The following researchers reported these and other Oracle vulnerabilities:
Anonymous of TippingPoint (3com); Esteban Martinez Fayo of Application Security, Inc.; Alexander Kornbrust of Red Database Security; David Litchfield of NGS Software; Brian Martin of INS.com; Guy Pilosof of Sentrigo; JPCERT/CC Vulnerability Handling Team; Daiki Fukumori [Secure Sky Technology] of JPCERT/CC Vulnerability Handling Team; and Dennis Yurichev.
|
Impact:
A remote user can take full control of the target system.
A remote authenticated user can access or modify data on the target database.
A remote authenticated user can cause denial of service conditions.
|
Solution:
The vendor has issued a fix, described in their January 2010 Critical Patch Update advisory.
The Oracle advisory is available at:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2010.html
|
Vendor URL: www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2010.html (Links to External Site)
|
Cause:
Not specified
|
Underlying OS:
Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 12 Jan 2010 18:31:25 +0000
Subject: Oracle Database
|
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2010.html
|
|
Go to the Top of This SecurityTracker Archive Page
|
