Oracle E-Business Suite Flaw Lets Remote Users Partially Modify Data
|
|
SecurityTracker Alert ID: 1025801 |
|
SecurityTracker URL: http://securitytracker.com/id/1025801
|
|
CVE Reference:
CVE-2011-2246
(Links to External Site)
|
Date: Jul 19 2011
|
Impact:
Modification of system information, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, 12.1.3
|
Description:
A vulnerability was reported in Oracle E-Business Suite. A remote user can partially modify data on the target system.
A remote user can send specially crafted data via HTTP to the Business Intelligence Financials component to partially modify data on the target system.
The following researchers reported these and other Oracle vulnerabilities:
Abdul-Aziz Hariri, reported through Secunia; Alexander Kornbrust of Red Database Security; Alexandr Polyakov of Digital Security; Brett Gervasoni of Sense of Security; CERT/CC; Dennis Yurichev; Esteban Martinez Fayo of Application Security, Inc.; Guy Pilosof of McAfee Security Research; Laszlo Toth; Michael Myngerbayev of McAfee Security Research; Monarch2020 of unsecurityresearch; Ofer Maor of Hacktics; Okan Basegmez of DORASEC Consulting; Paul M. Wright formerly of NGS Software; Scott Laurie of MWR InfoSecurity; Sow Ching Shiong, reported through Secunia; Steven Seeley of Corelan Team; Sumit Siddharth from 7safe; Tenable Network Security of TippingPoint's Zero Day Initiative; and Will Dormann of CERT/CC.
|
Impact:
A remote user can partially modify data on the target system.
|
Solution:
The vendor has issued a fix, described in their July 2011 Critical Patch Update advisory.
The vendor's advisory is available at:
http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html
|
Vendor URL: www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html (Links to External Site)
|
Cause:
Not specified
|
Underlying OS:
Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 19 Jul 2011 22:35:05 +0000
Subject: Oracle E-Business Suite
|
CVE-2011-2246
|
|
